Is CVE-2019-16777 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-16777 being exploited in the wild.

How severe is CVE-2019-16777?

Low severity, with a CVSS score of 3.1, published 13 December 2019.

Is there a fix for CVE-2019-16777?

A patch was published on 2019-12-13: npm 6.13.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-16777 attacked?

It is attacked over the network.

Am I affected by CVE-2019-16777?

Check whether you run npm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-16777: npm global node_modules binary overwrite

CVE-2019-16777 · Severity: low · CVSS 3.1 · Published 2019-12-13

npm is a package manager used by millions of developers to install and manage JavaScript libraries. Versions prior to 6.13.4 fail to prevent globally-installed command-line binaries from being overwritten when other packages create files with the same name. An attacker could craft a malicious package that, when installed globally, overwrites legitimate binaries already in use—potentially allowing code execution if a user runs the compromised binary.

Technologies: npm (npm). Vendors: npm.

Quick answers

Is CVE-2019-16777 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-16777 being exploited in the wild.
How severe is CVE-2019-16777?: Low severity, with a CVSS score of 3.1, published 13 December 2019.
Which products and versions are affected?: npm (npm) <6.13.4.
Is there a fix for CVE-2019-16777?: A patch was published on 2019-12-13: npm 6.13.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-16777 attacked?: It is attacked over the network.
Am I affected by CVE-2019-16777?: Check whether you run npm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a path traversal/binary planting issue (CWE-22, CWE-269) in npm's installation logic. When installing packages globally, npm does not adequately verify or protect existing binaries already present in the global node_modules bin directory. An attacker can craft a malicious package with a bin field that references an existing binary name, and upon installation, overwrite the legitimate binary with malicious code. The vulnerability requires user interaction (the victim must install a malicious package) and affects only global installations via direct npm install commands; it bypasses the --ignore-scripts flag and persists even when users attempt to avoid running install scripts. The fix is to upgrade npm to version 6.13.4 or later, which implements proper permission checks and protection for existing binaries.

Affected products

npm npm <6.13.4

Identifiers

CVE-2019-16777
GHSA-4328-8hgf-7wjr

Timeline

2019-12-13: disclosed
2019-12-13: patched: npm 6.13.4 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.