Skip to content
OpenAdvisories

Package · Debian

node-tmp

2 known vulnerabilities.

All Critical High Medium Low Exploited only

2 results · Feed

  • High 7.7
    CVE-2026-44705

    tmp: Path Traversal via unsanitized prefix/postfix enables directory escape

    tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By…

    raszi node-tmp node-tmp tmp Debian Ubuntu npm
  • Low 2.5
    CVE-2025-54798

    tmp does not restrict arbitrary temporary file / directory write via symbolic link `dir` parameter

    tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.

    raszi node-tmp tmp node-tmp Debian Ubuntu npm