Npmjs

Records16All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high13CVSS 7.0–8.9

Exploited now

Npmjs records in CISA KEV

No Npmjs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Npm 8 records MEDIUM Tar 3 records MEDIUM Arborist 2 records LOW Hosted-git-info 1 record LOW Npm-user-validate 1 record LOW Semver 1 record HIGH

Records

8 records in Npm · all components

TI-2021-19484 CVE-2021-43616 · GHSA-ppxp-px5q-gwqm

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if…

MEDIUM 47

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02724 Published 2021-11-13 Fixed CWE-345

TI-2022-11785 CVE-2022-29244 · GHSA-hj9c-8jmm-8c52

npm packing does not respect root-level ignore files in workspaces

MEDIUM 46

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04004 Published 2022-06-13 Partial fix · 8.11.0 CWE-200

TI-2019-12556 CVE-2019-16776 · GHSA-x8qc-rrcw-4r46

Unauthorized File Access in npm CLI before before version 6.13.3

MEDIUM 41

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.03422 Published 2019-12-13 Partial fix · 6.13.3 CWE-22

TI-2016-03362 CVE-2016-3956 · GHSA-m5h6-hr3q-22h5

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before…

MEDIUM 41

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTT…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05456 Published 2016-07-02 Partial fix · 2.15.1, 3.8.3 CWE-200

TI-2019-12555 CVE-2019-16775 · GHSA-m6cx-g6qm-p2cx

Unauthorized File Access in npm CLI before before version 6.13.3

MEDIUM 40

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.03334 Published 2019-12-13 Partial fix · 6.13.3 CWE-61

TI-2019-12557 CVE-2019-16777 · GHSA-4328-8hgf-7wjr

Arbitrary File Overwrite in npm CLI

LOW 38

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.02126 Published 2019-12-13 Partial fix · 6.13.4 CWE-22

TI-2018-05346 CVE-2018-7408 · GHSA-ph34-pc88-72gc

An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0"…

LOW 34

An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.0032 Published 2018-02-22 Fixed in 5.7.1 CWE-732

TI-2020-11870 CVE-2020-15095 · GHSA-93f3-23rq-pjfp

Sensitive information exposure through logs in npm cli

LOW 21

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files.

CVSS 3.1MEDIUM 4.4 Local Low privileges User interaction EPSS 0.00404 Published 2020-07-07 Partial fix · 6.14.6 CWE-532

Open these records in search →

Critical	1
High	13
Medium	2
Low	0
No CVSS	0