CVE-2026-0775
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in npm cli allows local attackers to escalate privileges due to incorrect permission assignment when loading modules from an unsecured location. This can lead to arbitrary code execution in the context of a target user.
Risk Assessment
An attacker with low privileges can compromise another user's account, potentially leading to data confidentiality and integrity breaches on the system.
Recommendation
Immediately update npm cli to the latest patched version and restrict access to module directories for unprivileged users.
Other vulnerabilities in npm cli
See all- CVE-2020-15095Medium
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.
- CVE-2019-16777High
The npm CLI versions prior to 6.13.4 are vulnerable to Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries from being overwritten by other package installations, even with the --ignore-scripts option.
- CVE-2019-16776High
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. Through the bin field in package.json, a package publisher can access folders outside the intended node_modules directory and modify arbitrary files on a user's system during installation. This vulnerability bypasses the --ignore-scripts install option.
- CVE-2019-16775High
npm CLI versions prior to 6.13.3 are vulnerable to Arbitrary File Write. Packages can create symlinks to files outside node_modules via the bin field in package.json during installation, bypassing the --ignore-scripts option.
- CVE-2016-3956High
The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests. This allows remote HTTP servers to obtain sensitive information by reading Authorization headers.
Original NVD description (English source)
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS