Vulnerability Description
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Enterprise Linux | 8.0 |
| Redhat | Enterprise Linux Eus | 8.1 |
| Npmjs | Npm | < 6.13.3 |
| Opensuse | Leap | 15.1 |
| Oracle | Graalvm | 19.3.0.2 |
| Fedoraproject | Fedora | 31 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.htmlMailing ListThird Party Advisory
- https://access.redhat.com/errata/RHEA-2020:0330Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0573Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0579Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0597Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0602Third Party Advisory
- https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cliThird Party Advisory
- https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cxThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.oracle.com/security-alerts/cpujan2020.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.htmlMailing ListThird Party Advisory
- https://access.redhat.com/errata/RHEA-2020:0330Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0573Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0579Third Party Advisory
FAQ
What is CVE-2019-16775?
CVE-2019-16775 is a vulnerability with a CVSS score of 7.7 (HIGH). Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon ...
How severe is CVE-2019-16775?
CVE-2019-16775 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-16775?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Enterprise Linux, Redhat Enterprise Linux Eus, Npmjs Npm, Opensuse Leap, Oracle Graalvm.