# CVE-2021-39135: npm arborist symlink following vulnerability in node_modules

Source: https://junglewise.ai/threats/cve-2021-39135-npm-arborist-symlink-following-vulnerability-in-node-modules  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-39135 · Severity: low · CVSS 3.1 · Published 2021-08-31

@npmcli/arborist is a library used by npm to manage package installation and the node_modules folder structure. If an attacker can replace the node_modules directory with a symbolic link, arborist will write package contents to arbitrary locations on the file system, potentially leading to arbitrary code execution. This could be exploited by tricking developers into running npm install on a malicious repository.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-39135 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-39135 being exploited in the wild.

**How severe is CVE-2021-39135?** Low severity, with a CVSS score of 3.1, published 31 August 2021.

**Which products and versions are affected?** @npmcli/arborist (npm) <2.8.2.

**Is there a fix for CVE-2021-39135?** A patch was published on 2021-08-31: Version 2.8.2 released; included in npm v7.20.7+ Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-39135 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2021-39135?** Check whether you run @npmcli/arborist (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a symlink following issue (CWE-61, CWE-59) in @npmcli/arborist, the npm package dependency tree calculator and node_modules manager. When arborist extracts package contents into node_modules, it does not verify that node_modules is a real directory rather than a symbolic link; if node_modules is a symlink, arborist will follow it and write packages to an arbitrary filesystem location. An attacker can exploit this by supplying a malicious git repository and tricking a developer into running npm install, or by using a preinstall script to replace node_modules with a symlink. The attack requires local access and user interaction (developer running npm install), but achieves arbitrary file creation, overwrite, and potential code execution. Fixed in version 2.8.2 (included in npm v7.20.7+); the fix validates that node_modules is a real directory before extracting packages.

## Affected products

- npm @npmcli/arborist <2.8.2

## Identifiers

- CVE-2021-39135
- GHSA-gmw6-94gg-2rc2

## Timeline

- 2021-08-31: disclosed: GHSA-gmw6-94gg-2rc2 published
- 2021-08-31: patched: Version 2.8.2 released; included in npm v7.20.7+

## References

- [https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2](https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2)

## Related threats

- [npm Arborist symlink following on case-insensitive filesystems](https://junglewise.ai/threats/cve-2021-39134-npm-arborist-symlink-following-on-case-insensitive-filesystems)