Description
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| npm | cli | < 6.13.3 – < 6.13.3 | 6.13.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | npm | 6.13.4+ds-2 | — |
| Debian 13 | npm | 6.13.4+ds-2 | — |
| Debian 12 | npm | 6.13.4+ds-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | npm | No fix yet | — |
| Ubuntu 26.04 LTS | npm | No fix yet | — |
| Ubuntu 25.10 | npm | No fix yet | — |
| Ubuntu 24.04 LTS | npm | No fix yet | — |
| Ubuntu 22.04 LTS | npm | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | npm | No fix yet | — |
| Ubuntu 14.04 LTS | npm | No fix yet | — |
| Ubuntu Pro 18.04 LTS | npm | No fix yet | — |
| Ubuntu Pro 16.04 LTS | npm | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | nodejs +2 | 1:10.19.0-1.module+el8.1.0+5726+6ed65f8c | RHSA-2020:0579, RHEA-2020:0330 |
| RHEL 8 | nodejs-nodemon | 1.18.3-1.module+el8.1.0+3369+37ae6a45 | RHSA-2020:0579, RHEA-2020:0330 |
| RHEL 8 | nodejs-packaging | 17-3.module+el8.1.0+3369+37ae6a45 | RHSA-2020:0579, RHEA-2020:0330 |
| RHEL 8 | npm | 1:6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c | RHSA-2020:0579, RHEA-2020:0330 |
| RHEL 3 | rh-nodejs10-nodejs +2 | 10.19.0-1.el7 | RHSA-2020:0597 |
| RHEL 3 | rh-nodejs10-npm | 6.13.4-10.19.0.1.el7 | RHSA-2020:0597 |
| RHEL 3 | rh-nodejs12-nodejs +2 | 12.16.1-1.el7 | RHSA-2020:0602 |
| RHEL 3 | rh-nodejs12-npm | 6.13.4-12.16.1.1.el7 | RHSA-2020:0602 |
| RHEL 3 | rh-nodejs8-nodejs +2 | 8.17.0-2.el7 | RHSA-2020:2625 |
| RHEL 3 | rh-nodejs8-npm | 6.13.4-8.17.0.2.el7 | RHSA-2020:2625 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.0 E4S | nodejs +2 | 1:10.19.0-1.module+el8.0.0+5738+1362a79c | RHSA-2020:0573 |
| RHEL 8.0 E4S | nodejs-nodemon | 1.18.3-1.module+el8+2632+6c5111ed | RHSA-2020:0573 |
| RHEL 8.0 E4S | nodejs-packaging | 17-3.module+el8+2873+aa7dfd9a | RHSA-2020:0573 |
| RHEL 8.0 E4S | npm | 1:6.13.4-1.10.19.0.1.module+el8.0.0+5738+1362a79c | RHSA-2020:0573 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 | ALSA-2020:0579, ALEA-2020:0330 |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 | ALSA-2020:0579, ALEA-2020:0330 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 | RLSA-2020:0579 |
| Rocky Linux 8 | nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 | RLSA-2020:0579 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | nodejs10 | 10.18.0-1.15.1 | SUSE-SU-2020:0104-1 |
| SLES 15 SP1 | nodejs8 | 8.17.0-3.25.1 | SUSE-SU-2020:0043-1 |
| SLES 15 | nodejs10 | 10.18.0-1.15.1 | SUSE-SU-2020:0104-1 |
| SLES 15 | nodejs8 | 8.17.0-3.25.1 | SUSE-SU-2020:0043-1 |
| SLES 12 | nodejs10 | 10.18.0-1.15.1 | SUSE-SU-2020:0063-1 |
| SLES 12 | nodejs12 | 12.15.0-1.6.1 | SUSE-SU-2020:0429-1 |
| SLES 12 | nodejs6 | 6.17.1-11.30.1 | SUSE-SU-2020:0247-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | nodejs6 | 6.17.1-11.30.1 | SUSE-SU-2020:0247-1 |
| SUSE OpenStack Cloud Crowbar 8 | nodejs6 | 6.17.1-11.30.1 | SUSE-SU-2020:0247-1 |
| SUSE OpenStack Cloud 7 | nodejs6 | 6.17.1-11.30.1 | SUSE-SU-2020:0247-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | nodejs8 | 8.17.0-lp151.2.9.1 | openSUSE-SU-2020:0059-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | nodejs +2 | 1:10.19.0-1.module+el8.1.0+5552+3cab52c0 | ELSA-2020-0579 |
| Oracle Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.1.0+5392+4d6b561f | ELSA-2020-0579 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.1.0+5392+4d6b561f | ELSA-2020-0579 |
| Oracle Linux 8 | npm | 1:6.13.4-1.10.19.0.1.module+el8.1.0+5552+3cab52c0 | ELSA-2020-0579 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | npm | < 6.13.3 | 6.13.3 | GHSA-x8qc-rrcw-4r46 |
Advisories 18
- ALEA-2020:0330 nodejs:12 enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2020:0579 Important: nodejs:10 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-2183 Red Hat Software Collections: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 2, 2026
- RHSA-2020:0602 Red Hat Security Advisory: rh-nodejs12-nodejs security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:0597 Red Hat Security Advisory: rh-nodejs10-nodejs security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:0579 Red Hat Security Advisory: nodejs:10 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:0573 Red Hat Security Advisory: nodejs:10 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHEA-2020:0330 Red Hat Enhancement Advisory: nodejs:12 enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2020:2625 Red Hat Security Advisory: rh-nodejs8-nodejs security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RLSA-2020:0579 Important: nodejs:10 security update Rocky Linux Security Advisories · Feb 5, 2026
- SUSE-SU-2020:0104-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0059-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0247-1 Security update for nodejs6 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0043-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0429-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0063-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
- ELSA-2020-0579 Important: nodejs:10 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 26, 2020
References
- https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
- https://github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46
- https://www.oracle.com/security-alerts/cpujan2020.html
- openSUSE-SU-2020:0059 vendor-advisory
- FEDORA-2020-595ce5e3cc vendor-advisory
- RHEA-2020:0330 vendor-advisory
- RHSA-2020:0573 vendor-advisory
- RHSA-2020:0579 vendor-advisory
- RHSA-2020:0597 vendor-advisory
- RHSA-2020:0602 vendor-advisory