Lucene search

npm symlink reference outside of node_modules

🗓️ 13 Dec 2019 15:26:39Reported by GitHub Advisory DatabaseType

npm symlink vulnerability in versions prior to 6.13.

Reporter	Title	Published	Views	Family All 71
Veracode	Arbitrary File Overwrite	12 Dec 201903:16	–	veracode
Prion	Code injection	13 Dec 201901:15	–	prion
Cvelist	CVE-2019-16776 Unauthorized File Access in npm CLI before before version 6.13.3	13 Dec 201900:55	–	cvelist
UbuntuCve	CVE-2019-16776	13 Dec 201900:00	–	ubuntucve
OSV	CGA-M78G-5RXQ-8J78	25 Sep 202405:28	–	osv
OSV	CGA-7R52-GVRC-C3PV	25 Sep 202405:16	–	osv
OSV	CGA-HMQ4-GM5H-HPVW	25 Sep 202405:25	–	osv
OSV	npm symlink reference outside of node_modules	13 Dec 201915:39	–	osv
OSV	CGA-4G2V-Q782-WXQ4	25 Sep 202405:14	–	osv
OSV	CGA-F83R-HF7Q-6C4P	25 Sep 202405:21	–	osv

Vulners

Node

npmjs npmRange<6.13.3

Source	Link
github	www.github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-16776
blog	www.blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
github	www.github.com/advisories/GHSA-x8qc-rrcw-4r46
npmjs	www.npmjs.com/advisories/1436
access	www.access.redhat.com/errata/RHEA-2020:0330
access	www.access.redhat.com/errata/RHSA-2020:0573
access	www.access.redhat.com/errata/RHSA-2020:0579
access	www.access.redhat.com/errata/RHSA-2020:0597
access	www.access.redhat.com/errata/RHSA-2020:0602

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

13 Dec 2019 15:39Current

2.3Low risk

Vulners AI Score2.3

CVSS25.5

CVSS37.7 - 8.1

EPSS0.00132

CWE-22