# CVE-2019-16775: npm CLI arbitrary file write in bin field

Source: https://junglewise.ai/threats/cve-2019-16775-npm-cli-arbitrary-file-write-in-bin-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-12-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-16775 · Severity: low · CVSS 3.1 · Published 2019-12-13

The npm package manager (versions prior to 6.13.3) allows a malicious package to create files or symlinks outside the intended installation directory when a user installs the package. A package publisher could exploit this to write files to arbitrary locations on a developer's system with the permissions of the user running npm install, potentially compromising the system or enabling further attacks.

Technologies: [npm (npm)](https://junglewise.ai/threats/technologies/npm). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-16775 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-16775 being exploited in the wild.

**How severe is CVE-2019-16775?** Low severity, with a CVSS score of 3.1, published 13 December 2019.

**Which products and versions are affected?** npm (npm) <6.13.3.

**Is there a fix for CVE-2019-16775?** A patch was published on 2019-12-13: Version 6.13.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-16775 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-16775?** Check whether you run npm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability exists in the bin field processing of package.json, where npm fails to properly validate paths and prevent directory traversal. An attacker can craft a malicious package.json with specially constructed bin field entries that reference paths outside the node_modules directory, allowing creation of arbitrary files or symlinks. The vulnerability is network-reachable through package installation but requires a user to actively install the malicious package. The fix is available in npm CLI version 6.13.3 and later. Notably, this vulnerability can bypass the --ignore-scripts install option, making it particularly dangerous.

## Affected products

- npm npm <6.13.3

## Identifiers

- CVE-2019-16775
- GHSA-m6cx-g6qm-p2cx

## Timeline

- 2019-12-12: disclosed
- 2019-12-13: patched: Version 6.13.3 released
- 2019-12-13: advisory

## References

- [https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx](https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx)

## Related threats

- [npm cli local privilege escalation via uncontrolled module search path](https://junglewise.ai/threats/cve-2026-0775-npm-cli-local-privilege-escalation-via-uncontrolled-module-search)
- [npm pack root-level ignore file bypass in workspaces](https://junglewise.ai/threats/cve-2022-29244-npm-pack-root-level-ignore-file-bypass-in-workspaces)
- [npm incorrect permission assignment in mkdir](https://junglewise.ai/threats/cve-2018-7408-npm-incorrect-permission-assignment-in-mkdir)
- [npm Arborist symlink following on case-insensitive filesystems](https://junglewise.ai/threats/cve-2021-39134-npm-arborist-symlink-following-on-case-insensitive-filesystems)
- [npm public path traversal via symlink navigation](https://junglewise.ai/threats/npm-public-path-traversal-via-symlink-navigation-dd9ade29)