CVE-2019-16775 Unauthorized File Access in npm CLI before before version 6.13.3

High 7.7 Published 13 Dec 2019 Updated 5 Aug 2024

Malicious npm packages can create symlinks to arbitrary files outside node_modules, allowing unauthorized file modification during installation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-16775?

CVE-2019-16775 is a high-severity path traversal vulnerability in Fedoraproject Fedora, published on 13 Dec 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Weakness: CWE-59, CWE-61

Which versions are affected by CVE-2019-16775?

2 open source packages ship an affected version, including npm. It affects 6 products.

Package	Affected	Fixed in
`npm` npm	All versions	`6.13.3`
`npm` npm	All versions	`6.13.3`

Products include Fedoraproject Fedora, Npmjs Npm, Opensuse Leap, Oracle Graalvm, Redhat Enterprise Linux, Redhat Enterprise Linux Eus.

How do I fix CVE-2019-16775?

Upgrade npm to 6.13.3 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-16775 being exploited?

There is no known exploitation of CVE-2019-16775 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2019-16775, GHSA-m6cx-g6qm-p2cx, MINI-f5xp-cjg6-fhpm, UBUNTU-CVE-2019-16775.