CVE-2019-16775: npm - Symlink reference outside of node_modules folder through the bin field upon installation
Summary
CVE-2019-16775: Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. Affects npm across 2 version ranges.
< 6.13.4+ds-2
< 45482c25c0d169179fe56d1877e60361993cc8bd
Fixed in 6.13.4+ds-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
npm is a popular package manager for JavaScript that allows developers to easily install, manage, and share code packages. It is widely used in the Node.js ecosystem and plays a crucial role in building JavaScript applications. However, versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. This vulnerability allows packages to create symlinks to files outside of the node_modules folder through the bin field upon installation. A package publisher can exploit this vulnerability to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior can also be triggered through install scripts, bypassing the user's --ignore-scripts install option.
Vulnerability Detail
The vulnerability, identified as CVE-2019-16775, poses a significant security risk to users of npm. By manipulating the package.json bin field, an attacker can create symlinks to sensitive files outside of the intended scope, potentially leading to unauthorized access, data leakage, or code execution. This vulnerability affects npm versions prior to 6.13.3 and can be exploited by malicious package publishers or through compromised packages with malicious install scripts.
How To Fix
Minimum fixed version
6.13.4+ds-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade npmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update npm to the fixed version as soon as possible.
Conclusion
The vulnerability in npm versions prior to 6.13.3 allows package publishers or compromised packages to create symlinks to arbitrary files on a user's system. To mitigate this risk, it is crucial to update npm to version 6.13.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for npm →
FAQ
npm is a package manager for JavaScript that allows developers to easily install, manage, and share code packages.
This vulnerability allows package publishers or compromised packages to create symlinks to arbitrary files on a user's system, potentially leading to unauthorized access, data leakage, or code execution.
To fix this vulnerability, update npm to version 6.13.3 or later by running 'npm install -g npm@6.13.3' in the terminal.
No, there is no known workaround for this vulnerability. Updating npm to the fixed version is the recommended solution.
Yes, this vulnerability can be exploited remotely if a user installs a malicious package or a package with a compromised install script.
Related vulnerabilities
Recent vulnerabilities recorded for npm.
