Unauthorized File Access

Affecting node package, versions [12.0.0,12.14.0) || [10.0.0,10.18.0) || [8.0.0,8.17.0) || [13.0.0,13.4.0)

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Unauthorized File Access. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation.

For npm, a properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. This behaviour is possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Remediation

Upgrade node to version 12.14.0, 10.18.0, 8.17.0, 13.4.0 or higher.

References

CVSS Score

2.6
low severity
  • Attack Vector
    Network
  • Attack Complexity
    High
  • Privileges Required
    Low
  • User Interaction
    Required
  • Scope
    Unchanged
  • Confidentiality
    Low
  • Integrity
    None
  • Availability
    None
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Credit
Daniel Ruf
CVE
CVE-2019-16775
CWE
CWE-552
Snyk ID
SNYK-UPSTREAM-NODE-538287
Disclosed
11 Dec, 2019
Published
12 Dec, 2019