CVE-2019-16775: Arbitrary File Write in npm
Summary
CVE-2019-16775: Arbitrary File Write in npm. Affects npm versions < 6.13.3. Fixed in 6.13.3. How to fix ↓
Also tracked for
- npm · Debian:11
The same CVE-2019-16775 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
npm is a package manager for the JavaScript programming language. It is widely used to manage dependencies and install packages in Node.js projects. The npm CLI (Command Line Interface) is a command-line tool that interacts with the npm registry and facilitates package installation, version management, and script execution. However, versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write.
Vulnerability Detail
The vulnerability in npm CLI allows package publishers to create files on a user's system when the package is installed. This is possible due to a failure in preventing access to folders outside of the intended node_modules folder through the bin field in the package.json file. By crafting a specific entry in the bin field, an attacker can exploit this vulnerability and write files to the user's system. It is important to note that the attacker can only affect files that the user running npm install has access to, and it is not possible to overwrite existing files on disk. However, this vulnerability can still be exploited through install scripts, bypassing the user's use of the --ignore-scripts install option.
How To Fix
Latest published version: 12.2.1 as of 22 Oct 2026
npm install npm@12.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.13.3
This is the first release that contains the fix.
npm install npm@6.13.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in npm CLI prior to version 6.13.3 allows package publishers to write files to a user's system without proper authorization. This can be exploited through the bin field in the package.json file or install scripts. To mitigate this vulnerability, it is crucial to update the npm CLI to version 6.13.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for npm →
FAQ
npm is a package manager for the JavaScript programming language. It is widely used in Node.js projects to manage dependencies and install packages.
The npm CLI (Command Line Interface) is a command-line tool that interacts with the npm registry and facilitates package installation, version management, and script execution.
An Arbitrary File Write vulnerability allows an attacker to write files to a user's system without proper authorization. In the case of this npm vulnerability, it allows package publishers to create files on a user's system when the package is installed.
No, it is not possible to overwrite existing files on disk with this vulnerability. The attacker can only affect files that the user running npm install has access to.
To fix this vulnerability, it is recommended to upgrade to version 6.13.3 or later of the npm CLI. This version includes the necessary patches to prevent arbitrary file writes.
Related vulnerabilities
Recent vulnerabilities recorded for npm.
