CVE-2013-4116: Local Privilege Escalation in npm
Summary
CVE-2013-4116: Local Privilege Escalation in npm. Affects npm versions < 1.3.3. Fixed in 1.3.3. How to fix ↓
Also tracked for
- npm · Debian:11
The same CVE-2013-4116 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
npm is a package manager for the JavaScript programming language. It is widely used in the Node.js ecosystem to manage dependencies and facilitate the installation of libraries and frameworks. This vulnerability affects certain versions of npm and involves the use of predictable temporary file names during archive unpacking. This can be exploited by an attacker to create symbolic links at the location of these temporary files, allowing them to write to arbitrary files that the user owning the npm process has permission to write to. This vulnerability has the potential to result in local privilege escalation.
Vulnerability Detail
The vulnerability arises from the predictable temporary file names used by affected versions of npm during archive unpacking. By creating symbolic links at these locations, an attacker can gain unauthorized write access to files that the user owning the npm process can write to. This can lead to local privilege escalation, where the attacker can perform actions with elevated privileges. The impact of this vulnerability depends on the permissions of the affected files and the privileges of the user running the npm process.
How To Fix
Latest published version: 12.2.1 as of 22 Oct 2026
npm install npm@12.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.3
This is the first release that contains the fix.
npm install npm@1.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Updating to the patched version of npm is the recommended solution.
Conclusion
In conclusion, the vulnerability in npm allows for local privilege escalation by exploiting predictable temporary file names during archive unpacking. To mitigate this issue, it is crucial to update to version 1.3.3 or later of npm. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for npm →
FAQ
npm is a package manager for JavaScript that is commonly used in the Node.js ecosystem to manage dependencies and facilitate the installation of libraries and frameworks.
Local privilege escalation refers to the exploitation of a vulnerability that allows an attacker to gain elevated privileges on a system, enabling them to perform actions that are normally restricted to privileged users.
An attacker can create symbolic links by leveraging the predictable temporary file names used by npm during archive unpacking. By creating a symbolic link at the location of a temporary file, the attacker can redirect write operations to a file of their choice.
The consequences of this vulnerability depend on the permissions of the affected files and the privileges of the user running the npm process. If the user has write access to sensitive files, an attacker could modify or overwrite them, potentially leading to further compromise of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for npm.
