LOW2.5npm
GHSA-52f5-9888-hmc6· CVE-2025-54798tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter
Modified: 9/10/2026
package
npm/tmp
pkg:npm/tmp
HIGH8.2npm
GHSA-7c78-jf6q-g5cm· CVE-2026-49982tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template
Modified: 9/10/2026
HIGHnpm
GHSA-ph9p-34f9-6g65· CVE-2026-44705tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
Modified: 9/10/2026