CVE-2021-39135: UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
Summary
CVE-2021-39135: UNIX Symbolic Link (Symlink) Following in @npmcli/arborist. Affects @npmcli/arborist versions < 2.8.2. Fixed in 2.8.2. How to fix ↓
Also tracked for
- nodejs · Alpine:v3.11
The same CVE-2021-39135 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @npmcli/arborist library is responsible for calculating dependency trees and managing the node_modules folder hierarchy for the npm command line interface. It ensures that package dependency contracts are met and extracts package contents into the expected folder. However, a vulnerability exists in versions prior to 2.8.2 that allows an attacker to replace the node_modules folder with a symbolic link, leading to arbitrary file creation, overwrite, and potential code execution.
Vulnerability Detail
The vulnerability arises when the node_modules folder of the root project or any of its dependencies is replaced with a symbolic link. This allows Arborist to write package dependencies to any arbitrary location on the file system. While symbolic links contained within package artifact contents are filtered out, there are two potential scenarios for exploiting this vulnerability: 1) a preinstall script could replace node_modules with a symlink (prevented by using --ignore-scripts), or 2) an attacker could supply the target with a git repository and instruct them to run npm install --ignore-scripts in the root. The issue is fixed in version 2.8.2.
How To Fix
Minimum fixed version
2.8.2
This is the first release that contains the fix.
npm install @npmcli/arborist@2.8.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in @npmcli/arborist prior to version 2.8.2 allows an attacker to replace the node_modules folder with a symbolic link, leading to arbitrary file creation, overwrite, and potential code execution. It is crucial to update to version 2.8.2 or above to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @npmcli/arborist →
FAQ
The vulnerability allows an attacker to create arbitrary files, overwrite existing files, and potentially execute arbitrary code on the affected system.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file for analysis.
No, this vulnerability requires local access to the system in order to replace the node_modules folder with a symbolic link.
The only known mitigation is to update the @npmcli/arborist library to version 2.8.2 or above.
Yes, instead of creating symbolic links, you can use the npm link command, explicit file:... dependencies, or workspaces to share dependencies in a development environment.
Related vulnerabilities
Recent vulnerabilities recorded for @npmcli/arborist.
