CVE-2013-4116

Low

Published: 22/04/2014(UTC)Updated: 16/06/2026(UTC)Translated: 31/10/2026(UTC)NVD NIST

Summary

lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names created when unpacking archives.

Risk Assessment

A local user may overwrite arbitrary files with the privileges of the npm process, potentially leading to privilege escalation or system compromise.

Recommendation

Update npm to version 1.3.3 or later.

Other vulnerabilities in npm

CVE-2018-7408High
An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue.

Original NVD description (English source)

lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS