~ / search / GHSA-v3jv-wrf4-5845

GHSA-v3jv-wrf4-5845

Local Privilege Escalation in npm

Source: GitHub Advisory Database (reviewed) Low CVE-2013-4116

Packages

EcosystemPackageAffectedFixed in
npm npm < 1.3.3 1.3.3

Details

As written in the advisory (Markdown source, shown as plain text).

Affected versions of `npm` use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the `npm` process has permission to write to, potentially resulting in local privilege escalation. ## Recommendation Update to version 1.3.3 or later.

References

External links from the advisory. They lead to third-party sites.