Skip to content
OpenAdvisories

Package · Ubuntu

node-tmp

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.2
    CVE-2026-49982

    tmp: Type-confusion bypass of _assertPath in tmp@0.2.6 allows path traversal via non-string prefix/postfix/template

    tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array…

    raszi node-tmp tmp node-tmp Ubuntu npm
  • High 7.7
    CVE-2026-44705

    tmp: Path Traversal via unsanitized prefix/postfix enables directory escape

    tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By…

    raszi node-tmp tmp node-tmp Debian Ubuntu npm