CVE-2018-7408: Incorrect Permission Assignment for Critical Resource in npm
Summary
CVE-2018-7408: Incorrect Permission Assignment for Critical Resource in NPM. Affects npm versions < 5.7.1. Fixed in 5.7.1. How to fix ↓
Also tracked for
- npm · ghsa
The same CVE-2018-7408 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
npm is a popular package manager for JavaScript that allows developers to easily install, manage, and share code modules. It is widely used in the Node.js ecosystem and plays a crucial role in the development of JavaScript applications. However, a vulnerability has been discovered in npm version 5.7.0, which could potentially allow local users to bypass filesystem access restrictions. This vulnerability arises from an issue in the 'correctMkdir' function, which leads to unexpected ownership changes in the /etc and /usr directories.
Vulnerability Detail
The vulnerability in npm version 5.7.0 allows local users to bypass intended filesystem access restrictions. By exploiting this vulnerability, an attacker with local access to the system could gain unauthorized access to critical resources, potentially leading to privilege escalation, unauthorized modifications, or other malicious activities. The issue arises from incorrect permission assignment during the creation of directories, which results in unexpected ownership changes in the /etc and /usr directories. This could allow an attacker to manipulate or access sensitive files and directories that should be restricted.
How To Fix
Latest published version: 12.2.1 as of 22 Oct 2026
npm install npm@12.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.7.1
This is the first release that contains the fix.
npm install npm@5.7.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to follow the recommended fix and upgrade to the latest version of npm.
Conclusion
In conclusion, the vulnerability in npm version 5.7.0 could allow local users to bypass filesystem access restrictions and gain unauthorized access to critical resources. It is crucial to upgrade to npm version 5.7.1 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for npm →
FAQ
npm is a package manager for JavaScript that allows developers to easily install, manage, and share code modules.
The vulnerability could allow local users to bypass filesystem access restrictions and gain unauthorized access to critical resources, potentially leading to privilege escalation or unauthorized modifications.
To fix this vulnerability, upgrade to npm version 5.7.1 or later by running 'npm install -g npm@5.7.1'. Ensure correct ownerships of /etc and /usr directories.
There are no specific workarounds mentioned for this vulnerability. It is recommended to upgrade to the latest version of npm.
You can find more information about this vulnerability in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-ph34-pc88-72gc/GHSA-ph34-pc88-72gc.json
References
Related vulnerabilities
Recent vulnerabilities recorded for npm.
