You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
CVE-2019-16775 - Medium Severity Vulnerability
Vulnerable Library - npm-6.10.0.tgz
a package manager for JavaScript
Library home page: https://registry.npmjs.org/npm/-/npm-6.10.0.tgz
Path to dependency file: sync-moltin-to-zendesk/package.json
Path to vulnerable library: sync-moltin-to-zendesk/node_modules/npm/package.json
Dependency Hierarchy:
Found in HEAD commit: 70c8b9e11fb96d209b8624671a9739aa15c35084
Vulnerability Details
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
Publish Date: 2019-12-13
URL: CVE-2019-16775
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
Release Date: 2019-12-13
Fix Resolution: npm - 6.13.3;yarn - 1.21.1
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: