Skip to content
Fencer Vulns
high 7.7

CVE-2019-16775 json

Unauthorized File Access in npm CLI before before version 6.13.3

published 2019-12-13 6 y ago modified 2026-09-10 1 mo ago also GHSA-m6cx-g6qm-p2cx , EUVD-2019-0798

cvss
7.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Patch / fix

  • npm npm 6.13.3
  • npm cli 6.13.3
  • npm Debian 14, Debian 13, Debian 12 6.13.4+ds-2

debian advisories DEBIAN-CVE-2019-16775

  • rh-nodejs8-nodejs RHEL 3 SOFTWARE_COLLECTIONS 8.17.0-2.el7
  • rh-nodejs8-npm RHEL 3 SOFTWARE_COLLECTIONS 6.13.4-8.17.0.2.el7
  • npm RHEL 8 1:6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c
  • nodejs RHEL 8 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c
  • nodejs-nodemon RHEL 8, RHEL 8.0 E4S 1.18.3-1.module+el8+2632+6c5111ed
  • nodejs-packaging RHEL 8, RHEL 8.0 E4S 17-3.module+el8+2873+aa7dfd9a
  • rh-nodejs10-nodejs RHEL 3 SOFTWARE_COLLECTIONS 10.19.0-1.el7
  • rh-nodejs10-npm RHEL 3 SOFTWARE_COLLECTIONS 6.13.4-10.19.0.1.el7

red hat advisories RHSA-2020:2625RHSA-2020:0579RHSA-2020:0597RHSA-2020:0573RHSA-2020:0602RHEA-2020:0330

  • nodejs12 SLE Module for Web and Scripting 12 12.15.0-1.6.1
  • nodejs6 SLE Module for Web and Scripting 12, OpenStack Cloud Crowbar 9, OpenStack Cloud Crowbar 8 +1 more 6.17.1-11.30.1
  • nodejs10 SLE Module for Web and Scripting 15 SP1, SLE Module for Web and Scripting 15, SLE Module for Web and Scripting 12 10.18.0-1.15.1
  • nodejs8 SLE Module for Web and Scripting 15 SP1, SLE Module for Web and Scripting 15 8.17.0-3.25.1

suse advisories SUSE-SU-2020:0429-1SUSE-SU-2020:0247-1SUSE-SU-2020:0104-1SUSE-SU-2020:0063-1SUSE-SU-2020:0043-1

  • nodejs8 openSUSE Leap 15.1 8.17.0-lp151.2.9.1

opensuse advisories openSUSE-SU-2020:0059-1

  • nodejs-nodemon AlmaLinux 8 1.18.3-1.module_el8.3.0+2023+d2377ea3
  • nodejs-nodemon AlmaLinux 8 1.18.3-1.module_el8.3.0+2047+b07ac28e
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.4.0+2224+b07ac28e
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.4.0+2521+c668cc9f
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.3.0+2023+d2377ea3

almalinux advisories ALSA-2020:0579ALEA-2020:0330

  • nodejs-nodemon Rocky Linux 8 1.18.3-1.module+el8.3.0+101+f84c7154
  • nodejs-packaging Rocky Linux 8 17-3.module+el8.3.0+101+f84c7154

rocky linux advisories RLSA-2020:0579

  • npm Arch Linux 6.13.4-1

arch linux advisories AVG-1082

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-16775 updated cvss 4.8

npm: Symlink reference outside of node_modules folder through the bin field upon installation

  • Red Hat OpenShift Application Runtimes nodejs8 nodejs8
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 10.19.0-1.module+el8.1.0+5726+6ed65f8c, nodejs 12.14.1-1.module+el8.1.0+5466+30f75629, nodejs-packaging 17-3.module+el8+2873+aa7dfd9a, nodejs-nodemon 1.18.3-1.module+el8+2632+6c5111ed, nodejs-packaging 17-3.module+el8.1.0+3369+37ae6a45, npm 6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c, +2 more
    fixed: vendor fix RHSA-2020:0579
  • Red Hat Enterprise Linux AppStream E4S (v. 8.0) nodejs 10.19.0-1.module+el8.0.0+5738+1362a79c, nodejs-packaging 17-3.module+el8+2873+aa7dfd9a, nodejs-nodemon 1.18.3-1.module+el8+2632+6c5111ed, npm 6.13.4-1.10.19.0.1.module+el8.0.0+5738+1362a79c
    fixed: vendor fix RHSA-2020:0573
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs8-nodejs 8.17.0-2.el7, rh-nodejs10-nodejs 10.19.0-1.el7, rh-nodejs12-nodejs 12.16.1-1.el7, rh-nodejs8-npm 6.13.4-8.17.0.2.el7, rh-nodejs10-npm 6.13.4-10.19.0.1.el7, rh-nodejs12-npm 6.13.4-12.16.1.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs10-nodejs 10.19.0-1.el7, rh-nodejs12-nodejs 12.16.1-1.el7, rh-nodejs10-npm 6.13.4-10.19.0.1.el7, rh-nodejs12-npm 6.13.4-12.16.1.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs8-nodejs 8.17.0-2.el7, rh-nodejs10-nodejs 10.19.0-1.el7, rh-nodejs12-nodejs 12.16.1-1.el7, rh-nodejs8-npm 6.13.4-8.17.0.2.el7, rh-nodejs10-npm 6.13.4-10.19.0.1.el7, rh-nodejs12-npm 6.13.4-12.16.1.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs8-nodejs 8.17.0-2.el7, rh-nodejs10-nodejs 10.19.0-1.el7, rh-nodejs12-nodejs 12.16.1-1.el7, rh-nodejs8-npm 6.13.4-8.17.0.2.el7, rh-nodejs10-npm 6.13.4-10.19.0.1.el7, rh-nodejs12-npm 6.13.4-12.16.1.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs8-nodejs 8.17.0-2.el7, rh-nodejs10-nodejs 10.19.0-1.el7, rh-nodejs12-nodejs 12.16.1-1.el7, rh-nodejs8-npm 6.13.4-8.17.0.2.el7, rh-nodejs10-npm 6.13.4-10.19.0.1.el7, rh-nodejs12-npm 6.13.4-12.16.1.1.el7
    fixed: vendor fix RHSA-2020:0597

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.90% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N
GitHub 3.1 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm npm
<6.13.3
6.13.3

Affected products

  • npm cli

Classification

Weakness
  • CWE-61 UNIX Symbolic Link (Symlink) Following
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.