CVE-2026-0775: npm Package Local Privilege Escalation Vulnerability
Summary
CVE-2026-0775: npmcli: npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- npm · npm
The same CVE-2026-0775 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
npm (Node Package Manager) is a widely used package manager for JavaScript, allowing developers to install, share, and manage dependencies in their projects. The npm CLI (Command Line Interface) is essential for interacting with the npm registry and managing packages. However, a security vulnerability has been identified that could allow local attackers to escalate privileges on systems using affected versions of npm.
Vulnerability Detail
The npm cli has a vulnerability related to incorrect permission assignment, which can lead to local privilege escalation. This issue arises from the way npm handles modules, specifically loading them from unsecured locations. An attacker with low-privileged access can exploit this flaw to execute arbitrary code with elevated privileges, potentially compromising the entire system. The vulnerability is classified under CWE-732, indicating improper permission assignment.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can restrict access to the npm CLI for untrusted users or limit the execution of scripts that could be exploited. Additionally, ensure that your system's security policies are configured to minimize the risk of privilege escalation.
Conclusion
CVE-2026-0775 is a significant vulnerability in the npm package that can lead to local privilege escalation. It is crucial for users to update their npm installations to the latest version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for npm →
FAQ
CVE-2026-0775 is a vulnerability in the npm package that allows local attackers to escalate privileges due to incorrect permission assignments in the npm CLI.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can allow attackers to execute arbitrary code with elevated privileges, potentially compromising the entire system.
Yes, updating npm to the latest version will patch this vulnerability. Use the command npm install -g npm@latest to update.
If an immediate update is not possible, consider implementing security measures to restrict access to the npm CLI and monitor for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for npm.
