CVE-2016-10538: Arbitrary File Write in cli
Summary
CVE-2016-10538: Arbitrary File Write in cli. Affects cli versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cli package is an npm package that provides a command-line interface (CLI) for executing various tasks. It is commonly used in Node.js applications to create command-line tools. The package allows developers to define commands, options, and arguments for their CLI applications. However, versions of cli prior to 1.0.0 are vulnerable to an arbitrary file write vulnerability.
Vulnerability Detail
The vulnerability in cli arises from the use of predictable temporary file names. Attackers can exploit this by creating symbolic links at the locations of these temporary files. By doing so, they can overwrite any file that the user owning the cli process has permission to write to. This can lead to unauthorized modification or destruction of important files, potentially compromising the integrity and security of the system.
How To Fix
Latest published version: 1.0.1 as of 22 Oct 2026
npm install cli@1.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
npm install cli@1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The cli package prior to version 1.0.0 is vulnerable to arbitrary file write attacks. It is crucial to update to the fixed version to prevent potential unauthorized modifications or destruction of files. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for cli →
FAQ
The vulnerability allows attackers to write arbitrary files on the system, potentially leading to unauthorized modification or destruction of important files.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for vulnerabilities.
There are no known exploits for this vulnerability at the moment. However, it is important to update to the fixed version of the cli package to prevent potential attacks.
It is not recommended to manually fix this vulnerability without updating the package. Updating to the fixed version ensures that the underlying issue is properly addressed and mitigated.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for cli.
