Read the docs
TI-2019-12557 Aliases CVE-2019-16777GHSA-4328-8hgf-7wjr

Arbitrary File Overwrite in npm CLI

Priority LOW 38CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 7 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-269.

Summary

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Why it matters now

EPSS 0.02126 82nd percentileScored 2026-11-07
Fix Partial cli (npm): 6.13.4npm (npm): 6.13.4Red Hat: 5 advisoriesRed Hat: 7 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
npmcli< 6.13.4 to before 6.13.46.13.4Patch availableCNA
—npm (npm)before 6.13.46.13.4Patch availableGHSA-4328-8hgf-7wjr
  • cli Vendornpm Affected < 6.13.4 to before 6.13.4 Fixed in 6.13.4 Patch available CNA
  • npm (npm) Vendor— Affected before 6.13.4 Fixed in 6.13.4 Patch available GHSA-4328-8hgf-7wjr

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:*before 6.13.4VulnerableNpmjs
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:a:oracle:graalvm:19.3.0.2:*:*:*:enterprise:*:*:*19.3.0.2VulnerableOracle
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*8.1VulnerableRed Hat
  • cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:* Versions before 6.13.4 Vulnerable ·Npmjs
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:a:oracle:graalvm:19.3.0.2:*:*:*:enterprise:*:*:* Versions 19.3.0.2 Vulnerable ·Oracle
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Red Hat

Remediation

  • Fix · CNA cli (npm) Fixed in 6.13.4
  • Fix · GHSA-4328-8hgf-7wjr npm (npm) Fixed in 6.13.4 Advisory →

Red Hat 5 advisories

  • RHSA-2020:2625 Released 2020-06-19 · Red Hat rating Moderate
    rh-nodejs8-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs8-nodejs-8.17.0-2.el7, rh-nodejs8-nodejs-devel-8.17.0-2.el7, rh-nodejs8-nodejs-docs-8.17.0-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs8-nodejs-8.17.0-2.el7, rh-nodejs8-nodejs-devel-8.17.0-2.el7, rh-nodejs8-nodejs-docs-8.17.0-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs8-nodejs-8.17.0-2.el7, rh-nodejs8-nodejs-devel-8.17.0-2.el7, rh-nodejs8-nodejs-docs-8.17.0-2.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs8-nodejs-8.17.0-2.el7, rh-nodejs8-nodejs-devel-8.17.0-2.el7, rh-nodejs8-nodejs-docs-8.17.0-2.el7 +1
  • RHSA-2020:0602 Released 2020-02-25 · Red Hat rating Important
    rh-nodejs12-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.16.1-1.el7, rh-nodejs12-nodejs-devel-12.16.1-1.el7, rh-nodejs12-nodejs-docs-12.16.1-1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs12-nodejs-12.16.1-1.el7, rh-nodejs12-nodejs-devel-12.16.1-1.el7, rh-nodejs12-nodejs-docs-12.16.1-1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs12-nodejs-12.16.1-1.el7, rh-nodejs12-nodejs-devel-12.16.1-1.el7, rh-nodejs12-nodejs-docs-12.16.1-1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.16.1-1.el7, rh-nodejs12-nodejs-devel-12.16.1-1.el7, rh-nodejs12-nodejs-docs-12.16.1-1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.16.1-1.el7, rh-nodejs12-nodejs-devel-12.16.1-1.el7, rh-nodejs12-nodejs-docs-12.16.1-1.el7 +1
  • RHSA-2020:0597 Released 2020-02-25 · Red Hat rating Important
    rh-nodejs10-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-nodejs-10.19.0-1.el7, rh-nodejs10-nodejs-devel-10.19.0-1.el7, rh-nodejs10-nodejs-docs-10.19.0-1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs10-nodejs-10.19.0-1.el7, rh-nodejs10-nodejs-devel-10.19.0-1.el7, rh-nodejs10-nodejs-docs-10.19.0-1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-nodejs-10.19.0-1.el7, rh-nodejs10-nodejs-devel-10.19.0-1.el7, rh-nodejs10-nodejs-docs-10.19.0-1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-nodejs-10.19.0-1.el7, rh-nodejs10-nodejs-devel-10.19.0-1.el7, rh-nodejs10-nodejs-docs-10.19.0-1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-nodejs-10.19.0-1.el7, rh-nodejs10-nodejs-devel-10.19.0-1.el7, rh-nodejs10-nodejs-docs-10.19.0-1.el7 +1
Show 2 more Red Hat advisories
  • RHSA-2020:0579 Released 2020-02-25 · Red Hat rating Important
    nodejs:10 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:10.19.0-1.module+el8.1.0+5726+6ed65f8c.aarch64::nodejs:10, nodejs-1:10.19.0-1.module+el8.1.0+5726+6ed65f8c.ppc64le::nodejs:10, nodejs-1:10.19.0-1.module+el8.1.0+5726+6ed65f8c.s390x::nodejs:10 +15
  • RHSA-2020:0573 Released 2020-02-24 · Red Hat rating Important
    nodejs:10 security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.0) nodejs-1:10.19.0-1.module+el8.0.0+5738+1362a79c.ppc64le::nodejs:10, nodejs-1:10.19.0-1.module+el8.0.0+5738+1362a79c.src::nodejs:10, nodejs-1:10.19.0-1.module+el8.0.0+5738+1362a79c.x86_64::nodejs:10 +9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    npm cli — openSUSE-SU-2020:0059

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2019-12556 Unauthorized File Access in npm CLI before before version 6.13.3Priority MEDIUM 41
    • TI-2019-12555 Unauthorized File Access in npm CLI before before version 6.13.3Priority MEDIUM 40
    Show all 3 records → Advisory →
  • Advisory ·

    npm cli — RHEA-2020:0330

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2019-12556 Unauthorized File Access in npm CLI before before version 6.13.3Priority MEDIUM 41
    • TI-2019-12555 Unauthorized File Access in npm CLI before before version 6.13.3Priority MEDIUM 40
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Application RuntimesAffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:0579
Red Hat Enterprise Linux AppStream E4S (v. 8.0)Fixed RHSA-2020:0573
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:0597, RHSA-2020:0602, RHSA-2020:2625
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2020:0597, RHSA-2020:0602
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2020:0597, RHSA-2020:0602, RHSA-2020:2625
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2020:0597, RHSA-2020:0602, RHSA-2020:2625
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:0597, RHSA-2020:0602, RHSA-2020:2625

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-16777
  2. 2026-10-03 Alias added: GHSA-4328-8hgf-7wjr

References

Advisory 13

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences