Vulnerability Description
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Npmjs | Npm | < 6.13.3 |
| Opensuse | Leap | 15.1 |
| Oracle | Graalvm | 19.3.0.2 |
| Fedoraproject | Fedora | 31 |
| Redhat | Enterprise Linux | 8.0 |
| Redhat | Enterprise Linux Eus | 8.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.htmlMailing ListThird Party Advisory
- https://access.redhat.com/errata/RHEA-2020:0330Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0573Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0579Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0597Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0602Third Party Advisory
- https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cliThird Party Advisory
- https://github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.oracle.com/security-alerts/cpujan2020.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.htmlMailing ListThird Party Advisory
- https://access.redhat.com/errata/RHEA-2020:0330Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0573Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0579Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0597Third Party Advisory
FAQ
What is CVE-2019-16776?
CVE-2019-16776 is a vulnerability with a CVSS score of 7.7 (HIGH). Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly c...
How severe is CVE-2019-16776?
CVE-2019-16776 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-16776?
Check the references section above for vendor advisories and patch information. Affected products include: Npmjs Npm, Opensuse Leap, Oracle Graalvm, Fedoraproject Fedora, Redhat Enterprise Linux.