VYPR
← All advisories
High severityNVD Advisory· Published Dec 13, 2019· Updated Aug 5, 2024

Unauthorized File Access in npm CLI before before version 6.13.3

CVE-2019-16776

Description

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2019-16776: Arbitrary file write in npm CLI before 6.13.3 via malicious bin field in package.json, allowing installation-time filesystem modifications.

Vulnerability

Description

The npm CLI prior to version 6.13.3 is vulnerable to an arbitrary file write due to insufficient validation of the bin field in package.json. The installer does not prevent symlinks or files created by the bin entry from pointing outside the intended node_modules directory, allowing a package publisher to write arbitrary files on the user's system during installation [1]. This behavior persists even when users employ the --ignore-scripts option, which is meant to disable install scripts [2].

Exploitation

Prerequisites

Exploitation requires a user to install a malicious npm package that contains a carefully crafted bin field. The attacker must be able to publish a package to a registry (public or private) that the victim installs from. No additional authentication or network position is required beyond the user's typical npm install workflow [3]. The vulnerability can be triggered without any special privileges or user interaction beyond the installation process.

Impact

If exploited, an attacker can overwrite or modify arbitrary files accessible to the user running the npm install command. This could lead to privilege escalation, code execution, or persistent compromise of the user's environment. The impact is limited only by the user's filesystem permissions [4].

Mitigation

The vulnerability is fixed in npm version 6.13.3. Red Hat has released updates for Red Hat Enterprise Linux 8 (nodejs-10.19.0) and other products to address this issue [1][2][3][4]. Users should update npm to the latest version or apply the relevant system patches to mitigate the risk.

References
  1. https://access.redhat.com/errata/RHSA-2020:0579
  2. RHEA-2020:0330 - Product Enhancement Advisory
  3. https://access.redhat.com/errata/RHSA-2020:0597
  4. https://access.redhat.com/errata/RHSA-2020:0602

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
npmnpm
< 6.13.36.13.3

Affected products

127

Patches

1
45482c25c0d1

6.13.3

https://github.com/npm/cliisaacsDec 10, 2019via osv
commit
2 files changed · +2 −2
  • package.json+1 −1 modified
    @@ -1,5 +1,5 @@
 {
-  "version": "6.13.2",
+  "version": "6.13.3",
   "name": "npm",
   "description": "a package manager for JavaScript",
   "keywords": [
  • package-lock.json+1 −1 modified
    @@ -1,6 +1,6 @@
 {
   "name": "npm",
-  "version": "6.13.2",
+  "version": "6.13.3",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

14

News mentions

0

No linked articles in our index yet.