LOW
GHSA-v3jv-wrf4-5845
Local Privilege Escalation in npm
Quick fix
GHSA-v3jv-wrf4-5845 — npm: upgrade to the fixed version with the command below.
npm install npm@1.3.3Details
Affected versions of `npm` use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the `npm` process has permission to write to, potentially resulting in local privilege escalation.
## Recommendation
Update to version 1.3.3 or later.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-4116[ADVISORY]
- https://github.com/npm/npm/issues/3635[WEB]
- https://github.com/npm/npm/commit/f4d31693[WEB]
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=715325[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=983917[WEB]
- https://exchange.xforce.ibmcloud.com/vulnerabilities/87141[WEB]
- https://github.com/npm/npm[PACKAGE]
- https://www.npmjs.com/advisories/152[WEB]
- http://www.openwall.com/lists/oss-security/2013/07/10/17[WEB]
- http://www.openwall.com/lists/oss-security/2013/07/11/9[WEB]
- http://www.securityfocus.com/bid/61083[WEB]