Executive brief
Vercel pkg is a tool used to package Node.js projects into standalone executable files. A security flaw exists where the tool places internal components into a predictable, shared temporary directory on Unix-like systems. A local attacker can exploit this by replacing these components with malicious code, potentially leading to unauthorized access or control when another user runs a packaged application.
Technical details
Vercel pkg (up to version 5.8.1) utilizes a hardcoded directory (/tmp/pkg/* on Unix systems) to store native code packages during execution. Because this directory is shared across users and uses predictable naming conventions without uniqueness, it is susceptible to a race condition or symlink-style attack. A local attacker with low privileges can pre-create or replace these executables with malicious versions. When a victim executes a pkg-bundled application, the system may run the attacker's code instead of the intended native components. This vulnerability is marked as 'won't fix' because the pkg project has been deprecated.
Affected products
- Vercel pkg <= 5.8.1
Timeline
- 2024-01-13: other: Project archived by owner
- 2024-02-09: disclosed
- 2024-02-09: advisory