CVE-2019-16776
Fixed in a distro release EPSS 3%CVSS 7.7
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
Products: npm cli
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | npm | 6.13.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 |
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2047+b07ac28e |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.4.0+2224+b07ac28e |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.4.0+2521+c668cc9f |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| Arch Linux | npm | 6.13.4-1 |
| Chainguard | code-server | 0 |
| Chainguard | code-server-compat | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-assets-19.2 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-19.3 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-19.4 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-19.5 | no fix |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.2 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.3 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.4 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.5 | no fix |
| Chainguard | gitlab-rails-ce-18.1 | 0 |
| Chainguard | gitlab-rails-ce-18.2 | 0 |
| Chainguard | gitlab-rails-ce-18.3 | 0 |
| Chainguard | gitlab-rails-ce-18.4 | 0 |
| Chainguard | gitlab-rails-ce-18.5 | 0 |
| Chainguard | gitlab-rails-ce-18.6 | 0 |
| Chainguard | gitlab-rails-ce-18.7 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.1 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.10 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.11 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.2 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.3 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.4 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.5 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.6 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.7 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.8 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.9 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.0 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.1 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.2 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.3 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.4 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.5 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.1 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.10 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.11 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.2 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.3 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.4 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.5 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.6 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.7 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.8 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.9 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.0 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.1 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.2 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.3 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.4 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.5 | 0 |
| Chainguard | gitlab-rails-ce-doc-18.1 | 0 |
| Chainguard | gitlab-rails-ce-doc-18.2 | 0 |
| Chainguard | gitlab-rails-ce-doc-18.3 | 0 |
| Chainguard | gitlab-rails-ce-doc-18.4 | 0 |
| Chainguard | gitlab-rails-ce-doc-18.5 | 0 |
| Chainguard | gitlab-rails-ce-doc-18.6 | 0 |
| Chainguard | gitlab-rails-ce-doc-18.7 | 0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.1 | 0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.2 | 0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.3 | 0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.4 | 0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.5 | 0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.6 | 0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.7 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.2 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.3 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.4 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.5 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.6 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.7 | 0 |
| Chainguard | gitlab-rails-ee-17.0 | 0 |
| Chainguard | gitlab-rails-ee-17.1 | 0 |
| Chainguard | gitlab-rails-ee-17.10 | 0 |
| Chainguard | gitlab-rails-ee-17.2 | 0 |
| Chainguard | gitlab-rails-ee-assets-17.10 | 0 |
| Chainguard | gitlab-rails-ee-assets-fips-17.10 | 0 |
| Chainguard | gitlab-rails-ee-doc-17.10 | 0 |
| Chainguard | gitlab-rails-ee-doc-fips-17.10 | 0 |
| Chainguard | gitlab-rails-ee-fips-17.0 | 0 |
| Chainguard | gitlab-rails-ee-fips-17.1 | 0 |
| Chainguard | gitlab-rails-ee-fips-17.10 | 0 |
| Chainguard | gitlab-rails-ee-fips-17.2 | 0 |
| Debian 12 | npm | 6.13.4+ds-2 |
| Debian 13 | npm | 6.13.4+ds-2 |
| Debian 14 | npm | 6.13.4+ds-2 |
| Red Hat Enterprise Linux 8 | nodejs | 1:12.14.1-1.module+el8.1.0+5466+30f75629 |
| Red Hat Enterprise Linux 8 | nodejs | 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:12.14.1-1.module+el8.1.0+5466+30f75629 |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:12.14.1-1.module+el8.1.0+5466+30f75629 |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:12.14.1-1.module+el8.1.0+5466+30f75629 |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c |
| Red Hat Enterprise Linux 8 | nodejs-devel-debuginfo | 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:12.14.1-1.module+el8.1.0+5466+30f75629 |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:1.18.3-1.module+el8+2632+6c5111ed |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:17-3.module+el8+2873+aa7dfd9a |
| Red Hat Enterprise Linux 8 | npm | 1:6.13.4-1.12.14.1.1.module+el8.1.0+5466+30f75629 |
| Red Hat Enterprise Linux 8 | npm | 1:6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c |
| Red Hat rhel e4s 8.0 | nodejs | 1:10.19.0-1.module+el8.0.0+5738+1362a79c |
| Red Hat rhel e4s 8.0 | nodejs-debuginfo | 1:10.19.0-1.module+el8.0.0+5738+1362a79c |
| Red Hat rhel e4s 8.0 | nodejs-debugsource | 1:10.19.0-1.module+el8.0.0+5738+1362a79c |
| Red Hat rhel e4s 8.0 | nodejs-devel | 1:10.19.0-1.module+el8.0.0+5738+1362a79c |
| Red Hat rhel e4s 8.0 | nodejs-devel-debuginfo | 1:10.19.0-1.module+el8.0.0+5738+1362a79c |
| Red Hat rhel e4s 8.0 | nodejs-docs | 1:10.19.0-1.module+el8.0.0+5738+1362a79c |
| Red Hat rhel e4s 8.0 | nodejs-nodemon | 0:1.18.3-1.module+el8+2632+6c5111ed |
| Red Hat rhel e4s 8.0 | nodejs-packaging | 0:17-3.module+el8+2873+aa7dfd9a |
| Red Hat rhel e4s 8.0 | npm | 1:6.13.4-1.10.19.0.1.module+el8.0.0+5738+1362a79c |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs | 0:10.19.0-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs-debuginfo | 0:10.19.0-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs-devel | 0:10.19.0-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs-docs | 0:10.19.0-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-npm | 0:6.13.4-10.19.0.1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs | 0:12.16.1-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-debuginfo | 0:12.16.1-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-devel | 0:12.16.1-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-docs | 0:12.16.1-1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-npm | 0:6.13.4-12.16.1.1.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-nodejs | 0:8.17.0-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-nodejs-debuginfo | 0:8.17.0-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-nodejs-devel | 0:8.17.0-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-nodejs-docs | 0:8.17.0-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-npm | 0:6.13.4-8.17.0.2.el7 |
| Rocky Linux 8 | nodejs-nodemon | 0:1.18.3-1.module+el8.3.0+101+f84c7154 |
| Rocky Linux 8 | nodejs-packaging | 0:17-3.module+el8.3.0+101+f84c7154 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs10 | 10.18.0-1.15.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs12 | 12.15.0-1.6.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs6 | 6.17.1-11.30.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 | nodejs10 | 10.18.0-1.15.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 | nodejs8 | 8.17.0-3.25.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP1 | nodejs10 | 10.18.0-1.15.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP1 | nodejs8 | 8.17.0-3.25.1 |
| SUSE OpenStack Cloud 7 | nodejs6 | 6.17.1-11.30.1 |
| SUSE OpenStack Cloud Crowbar 8 | nodejs6 | 6.17.1-11.30.1 |
| SUSE OpenStack Cloud Crowbar 9 | nodejs6 | 6.17.1-11.30.1 |
| Ubuntu 14.04 LTS | npm | no fix |
| Ubuntu 20.04 LTS | npm | no fix |
| Ubuntu 22.04 LTS | npm | no fix |
| Ubuntu 24.04 LTS | npm | no fix |
| Ubuntu 25.10 | npm | no fix |
| Ubuntu 26.04 LTS | npm | no fix |
| Ubuntu 26.10 | npm | no fix |
| Ubuntu Pro 16.04 LTS | npm | no fix |
| Ubuntu Pro 18.04 LTS | npm | no fix |
| Wolfi | code-server | 0 |
| Wolfi | code-server-compat | 0 |
| openSUSE Leap 15.1 | nodejs8 | 8.17.0-lp151.2.9.1 |