CVE-2019-16775: Unauthorized File Access in npm CLI before before version 6.13.3

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-13 · updated 2026-06-17
Weakness: CWE-61

Description

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Affected products

Fedoraproject Fedora: 31
Npmjs Npm: before 6.13.3 — fixed in 6.13.3
openSUSE Leap: 15.1
Oracle Corporation GraalVM Enterprise Edition: 19.3.0.2, 20.3.3, 21.2.2
Red Hat Enterprise Linux: 8.0
RedHat Enterprise Linux Eus: 8.1

How to fix

Upgrade to a fixed version: Npmjs Npm 6.13.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-16775 or the next vulnerability affects your stack