CWE data temporarily unavailableCWE data is currently experiencing intermittent outages, which may cause incomplete section loading on CVE pages. We are actively working on a fix.

CVE-2019-16776

Description

From CVE.org

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score4.88.1N/A
Attack VectorNetworkNetworkN/A
Attack ComplexityHighLowN/A
Privileges RequiredLowLowN/A
User InteractionRequiredNoneN/A
ScopeUnchangedUnchangedN/A
ConfidentialityNoneHighN/A
Integrity ImpactHighHighN/A
Availability ImpactNoneNoneN/A

Vector

Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N

NVD: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Red Hat CVSS v3 Score Explanation

The attacker needs to trick a victim into installing an untrusted, specially crafted, NPM package. In a protected environment, only packages that are trusted should be installed, since they are likely to get executed. Therefore the severity is considered Low.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.