Arbitrary File Write Vulnerability in @npmcli/arborist
Summary
CVE-2021-39135: @npmcli/arborist, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the ex... Affects nodejs across 4 version ranges.
< 12.22.6-r0
< 80f5029fc02274e5c1068891ee16ec2f42c4a534
< 96a49ea17d4a21f0d5a507feea09c33dc7080c9b
< dcacec99e061341a43e42cd0775612bd42b2d900
Fixed in 12.22.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @npmcli/arborist library is responsible for managing the node_modules folder hierarchy and calculating dependency trees for the npm command line interface. It ensures that package dependency contracts are met and extracts package contents into the expected folder. However, a vulnerability in this library allows an attacker to replace the node_modules folder with a symbolic link, enabling them to write package dependencies to any arbitrary location on the file system.
Vulnerability Detail
The vulnerability (CVE-2021-39135) arises from the ability to replace the node_modules folder with a symbolic link. This can be achieved through a preinstall script or by supplying a git repository and instructing the target to run 'npm install --ignore-scripts'. The issue is patched in @npmcli/arborist 2.8.2, included in npm v7.20.7 and above. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
12.22.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The arbitrary file write vulnerability in @npmcli/arborist allows an attacker to write package dependencies to any location on the file system. It is crucial to update to @npmcli/arborist 2.8.2 or above, included in npm v7.20.7 and later, to mitigate this vulnerability. For additional support, contact DevNack.com.
See every vulnerability recorded for nodejs →
FAQ
The vulnerability allows an attacker to write package dependencies to any location on the file system, potentially leading to unauthorized access, data loss, or code execution.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities.
There are no known exploits for this vulnerability at the moment. However, it is crucial to update to the patched version to mitigate any potential risks.
No, the vulnerability is specific to the @npmcli/arborist library. Updating npm to the latest version, which includes the patched library, is the recommended solution.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
