Read the docs
TI-2026-00558 Aliases CVE-2026-0775

Incorrect permission assignment in npm cli

Priority LOW 33CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00293 22nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
npmcli10.9.0—No fix listedCNA
  • cli Vendornpm Affected 10.9.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 34 products
  • Confidential Compute Attestation
  • Cryostat 4
  • Logging Subsystem for Red Hat OpenShift
  • Migration Toolkit for Containers
  • Multicluster Engine for Kubernetes
  • Network Observability Operator
  • Node HealthCheck Operator
  • OpenShift Lightspeed
  • OpenShift Pipelines
  • OpenShift Serverless
  • Red Hat 3scale API Management Platform 2
  • Red Hat AMQ Broker 7
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Connectivity Link 1
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift GitOps
  • Red Hat Openshift Data Foundation 4
  • Red Hat Quay 3
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat Trusted Artifact Signer
  • Red Hat build of Apache Camel - HawtIO 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-0775
  2. 2026-10-27 Affected versions changed · Red Hat

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences