CVE-2017-18869

Severity: low (CVSS 2.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-06-15 · updated 2026-06-17
Weakness: CWE-367

Description

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Affected products

Chownr Project Chownr: before 1.1.0 — fixed in 1.1.0

How to fix

Upgrade to a fixed version: Chownr Project Chownr 1.1.0. Check the vendor advisory for mitigations.

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863985
https://bugzilla.redhat.com/show_bug.cgi?id=1611614
https://github.com/isaacs/chownr/issues/14
https://snyk.io/vuln/npm:chownr:20180731
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863985
https://bugzilla.redhat.com/show_bug.cgi?id=1611614
https://github.com/isaacs/chownr/issues/14
https://snyk.io/vuln/npm:chownr:20180731

Get alerted when CVE-2017-18869 or the next vulnerability affects your stack