CVE-2019-16775: npm CLI arbitrary file write in bin field

CVE-2019-16775 · Severity: low · CVSS 3.1 · Published 2019-12-13

The npm package manager (versions prior to 6.13.3) allows a malicious package to create files or symlinks outside the intended installation directory when a user installs the package. A package publisher could exploit this to write files to arbitrary locations on a developer's system with the permissions of the user running npm install, potentially compromising the system or enabling further attacks.

Technologies: npm (npm). Vendors: npm.

Quick answers

Is CVE-2019-16775 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2019-16775 being exploited in the wild.
How severe is CVE-2019-16775?
Low severity, with a CVSS score of 3.1, published 13 December 2019.
Which products and versions are affected?
npm (npm) <6.13.3.
Is there a fix for CVE-2019-16775?
A patch was published on 2019-12-13: Version 6.13.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-16775 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2019-16775?
Check whether you run npm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability exists in the bin field processing of package.json, where npm fails to properly validate paths and prevent directory traversal. An attacker can craft a malicious package.json with specially constructed bin field entries that reference paths outside the node_modules directory, allowing creation of arbitrary files or symlinks. The vulnerability is network-reachable through package installation but requires a user to actively install the malicious package. The fix is available in npm CLI version 6.13.3 and later. Notably, this vulnerability can bypass the --ignore-scripts install option, making it particularly dangerous.

Affected products

  • npm npm <6.13.3

Identifiers

  • CVE-2019-16775
  • GHSA-m6cx-g6qm-p2cx

Timeline

  • 2019-12-12: disclosed
  • 2019-12-13: patched: Version 6.13.3 released
  • 2019-12-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.