Executive brief
npm, the Node.js package manager, uses predictable temporary file names when unpacking packages. An attacker with local file system access can create symbolic links at these predictable locations to cause npm to write files to arbitrary locations that the npm user has permission to access, potentially leading to privilege escalation or unauthorized file modification on a system.
Technical details
The vulnerability is a symlink attack (CWE-59) in npm's archive unpacking process. npm creates temporary files with predictable names (e.g., /tmp/npm-$PID) in world-writable directories during package installation and unpacking. An attacker can race the process or predict the PID to create a symbolic link at the temporary file location, causing subsequent file write operations to follow the symlink and write to arbitrary files accessible to the npm user. This allows privilege escalation if npm is run as a privileged user. No authentication is required; only local file system access is needed. The vulnerability was fixed in npm version 1.3.3 and later.
Affected products
- npm npm before 1.3.3
Timeline
- 2013-07-08: disclosed
- 2013: patched: Fixed in version 1.3.3
- 2020-09-01: advisory