CVE-2019-16776: npm symlink reference outside of node_modules
Summary
CVE-2019-16776: npm symlink reference outside of node_modules. Affects npm versions < 6.13.3. Fixed in 6.13.3. How to fix ↓
Also tracked for
- npm · Debian:11
The same CVE-2019-16776 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The npm package is a popular package manager for JavaScript. It is used to install, manage, and publish packages for Node.js. The vulnerability in question allows packages to create symlinks to files outside of the node_modules folder during installation. This can be achieved through the bin field in the package.json file. By exploiting this vulnerability, a package publisher can create a symlink pointing to arbitrary files on a user's system. However, it is important to note that only files accessible by the user running the npm install command are affected.
Vulnerability Detail
The vulnerability arises from the ability of packages to create symlinks to files outside of the node_modules folder. This can be done by including a properly constructed entry in the package.json bin field. When the package is installed, the symlink is created, pointing to a file outside of the node_modules folder. This can potentially lead to unauthorized access to sensitive files on the user's system. It is worth mentioning that this vulnerability can still be exploited through install scripts, bypassing the --ignore-scripts option.
How To Fix
Latest published version: 12.2.1 as of 22 Oct 2026
npm install npm@12.2.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.13.3
This is the first release that contains the fix.
npm install npm@6.13.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of the npm CLI.
Conclusion
The npm symlink reference vulnerability allows package publishers to create symlinks to arbitrary files outside of the node_modules folder. This can potentially lead to unauthorized access to sensitive files on a user's system. To mitigate this risk, it is recommended to upgrade to version 6.13.3 or later of the npm CLI. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for npm →
FAQ
This vulnerability allows package publishers to create symlinks to arbitrary files on a user's system. This can potentially lead to unauthorized access to sensitive files.
No, this vulnerability requires the user to run the npm install command. Only files accessible by the user running the command are affected.
No, versions prior to 6.13.3 are vulnerable. Upgrading to version 6.13.3 or later fixes the vulnerability.
No, upgrading to the fixed version is the recommended solution to mitigate the risk.
There are no known instances of this vulnerability being exploited in the wild.
Related vulnerabilities
Recent vulnerabilities recorded for npm.
