CVE-2016-1000021: Node CLI Allows Arbitrary File Overwrite
Summary
GHSA-3mrp-qhcj-mwv5: Duplicate Advisory: Node CLI Allows Arbitrary File Overwrite. Affects cli versions >= 0.1.0, < 1.0.0. Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Node CLI package is a command-line interface tool for Node.js applications. It provides a convenient way to interact with Node.js projects and execute various commands. The package is widely used in the npm ecosystem for building, testing, and managing Node.js applications. However, versions 0.1.0 through 0.11.3 of the Node CLI package are vulnerable to an arbitrary file overwrite issue.
Vulnerability Detail
The vulnerability in the Node CLI package arises from the use of predictable temporary file names in the lock_file and log_file functions. This allows an attacker to overwrite files on the system. By exploiting this vulnerability, an attacker could potentially modify critical files, leading to unauthorized access, data loss, or system compromise. The vulnerability has a CVSS score of 3.5, indicating a moderate severity level.
How To Fix
Latest published version: 1.0.1 as of 22 Oct 2026
npm install cli@1.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
npm install cli@1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the Node CLI package to the latest version to mitigate the risk of arbitrary file overwrite.
Conclusion
The Node CLI package versions 0.1.0 through 0.11.3 are vulnerable to an arbitrary file overwrite issue. To mitigate the risk, it is crucial to update the package to version 1.0.0 or higher. This will fix the vulnerability and prevent potential unauthorized access, data loss, or system compromise. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cli →
FAQ
The vulnerability allows an attacker to overwrite files on the system, which can lead to unauthorized access, data loss, or system compromise.
Yes, updating the Node CLI package to version 1.0.0 or higher fixes the vulnerability.
No, only versions 0.1.0 through 0.11.3 of the Node CLI package are affected.
No, there is no known workaround for this vulnerability. Updating the package is the recommended solution.
The CVSS score of this vulnerability is 3.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for cli.
