CVE-2026-0775: npm Local Privilege Escalation Vulnerability
Summary
CVE-2026-0775: npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. Affects npm versions < 11.8.0. No fix is published. How to fix ↓
Also tracked for
- npm · ghsa
The same CVE-2026-0775 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
npm is a widely used package manager for JavaScript, enabling developers to install, share, and manage dependencies in their projects. It provides a robust ecosystem for managing packages and modules, facilitating seamless integration and collaboration within the JavaScript community. However, npm is susceptible to security vulnerabilities, including the one described here, which can lead to significant risks if not addressed promptly.
Vulnerability Detail
The npm CLI has an Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This flaw arises from incorrect permission assignments in the handling of modules, allowing local attackers to escalate privileges on affected installations. An attacker must first execute low-privileged code on the target system to exploit this vulnerability. The specific issue is that npm loads modules from an unsecured location, enabling an attacker to execute arbitrary code in the context of a target user, potentially leading to unauthorized access and control over the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict the execution of low-privileged code on their systems and ensure that npm is configured to load modules from secure locations only. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The npm CLI vulnerability CVE-2026-0775 poses a significant risk of local privilege escalation due to improper handling of module permissions. Users are strongly advised to update to the latest version of npm to mitigate this risk and ensure their systems remain secure.
See every vulnerability recorded for npm →
FAQ
CVE-2026-0775 is a vulnerability in the npm CLI that allows local privilege escalation due to incorrect permission assignments in module handling.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to execute arbitrary code with elevated privileges, potentially compromising the entire system.
You can update npm by running the command 'npm install -g npm@latest' in your terminal to ensure you have the latest secure version.
Vulert monitors and alerts for open-source vulnerabilities in your software using just package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for npm.
