Remote Code Execution (RCE)

🗓️ 01 Sep 2021 03:51:53Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 33 Views

Vulnerability in @npmcli/arborist allows remote code execution via symlink dependenc

Reporter	Title	Published	Views	Family All 105
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-39134)	22 Apr 202219:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to a symlink attack due to CVE-2021-39134	7 Oct 202110:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js	29 Oct 202121:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security issues due to Node.js	22 Aug 202215:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Software included in Rational Developer for i	12 Dec 202119:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021	16 Nov 202119:47	–	ibm
IBM Security Bulletins	Security Bulletin: High severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)	27 Apr 202222:57	–	ibm
ALT Linux	Security fix for the ALT Linux 10 package node version 14.17.6-alt1	1 Sep 202100:00	–	altlinux
FreeBSD	Node.js -- August 2021 Security Releases (2)	31 Aug 202100:00	–	freebsd
AlpineLinux	CVE-2021-39134	31 Aug 202116:55	–	alpinelinux

Vulners

Node

nodejs nodejsMatch12.22.4-r0js

AND

nodejs nodejsMatch12.22.5-r0js

AND

nodejs nodejsMatch12.15.0-r1js

AND

nodejs nodejsMatch12.22.2-r0js

AND

nodejs nodejsMatch12.21.0-r0js

AND

nodejs nodejsMatch12.22.1-r0js

AND

alpinelinux alpine_linuxMatch3.11

nodejs nodejsMatch14.17.5-r0js

AND

nodejs nodejsMatch12.15.0-r1js

AND

nodejs nodejsMatch14.17.0-r0js

AND

nodejs nodejsMatch12.17.0-r0js

AND

nodejs nodejsMatch14.17.1-r0js

AND

nodejs nodejsMatch14.17.2-r0js

AND

nodejs nodejsMatch14.17.4-r0js

AND

nodejs nodejsMatch14.17.3-r0js

AND

nodejs nodejsMatch14.16.1-r2js

AND

nodejs nodejsMatch12.16.2-r0js

AND

nodejs nodejsMatch14.16.0-r1js

AND

nodejs nodejsMatch14.16.0-r0js

AND

alpinelinux alpine_linuxMatchedge

nodejs nodejsMatch12.17.0-r0js

AND

nodejs nodejsMatch12.22.5-r0js

AND

nodejs nodejsMatch12.22.1-r0js

AND

nodejs nodejsMatch12.22.2-r0js

AND

nodejs nodejsMatch12.22.4-r0js

AND

nodejs nodejsMatch12.16.3-r0js

AND

nodejs nodejsMatch12.21.0-r0js

AND

alpinelinux alpine_linuxMatch3.12

nodejs nodejsMatch14.17.3-r0js

AND

nodejs nodejsMatch14.17.1-r0js

AND

nodejs nodejsMatch14.17.5-r0js

AND

nodejs nodejsMatch14.17.4-r0js

AND

nodejs nodejsMatch14.17.0-r0js

AND

alpinelinux alpine_linuxMatch3.14

nodejs nodejsMatch14.16.1-r1js

AND

nodejs nodejsMatch14.17.3-r0js

AND

nodejs nodejsMatch14.17.4-r0js

AND

nodejs nodejsMatch14.16.0-r0js

AND

nodejs nodejsMatch14.17.5-r0js

AND

alpinelinux alpine_linuxMatch3.13

npmjs npmMatch7.0.12+ds-1debian

AND

debian debian_linuxMatch999

npmjs @npmcli/arboristRange0.0.0-pre.2–2.8.1js

Source	Link
github	www.github.com/advisories/GHSA-2h3h-q99f-3fhc
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
github	www.github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc
npmjs	www.npmjs.com/package/%40npmcli/arborist
npmjs	www.npmjs.com/package/@npmcli/arborist
oracle	www.oracle.com/security-alerts/cpuoct2021.html

07 Nov 2023 22:40Current

4.1Medium risk

Vulners AI Score4.1

CVSS 3.17.8 - 8.2

CVSS 24.4

EPSS0.00718