Vulnerabilities

TI-2022-11785 CVE-2022-29244 · GHSA-hj9c-8jmm-8c52

npm packing does not respect root-level ignore files in workspaces

MEDIUM 46

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04004 Published 2022-06-13 Partial fix · 8.11.0 CWE-200

TI-2021-19484 CVE-2021-43616 · GHSA-ppxp-px5q-gwqm

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if…

MEDIUM 47

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02617 Published 2021-11-13 Fixed CWE-345

TI-2020-11870 CVE-2020-15095 · GHSA-93f3-23rq-pjfp

Sensitive information exposure through logs in npm cli

LOW 21

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files.

CVSS 3.1MEDIUM 4.4 Local Low privileges User interaction EPSS 0.00404 Published 2020-07-07 Partial fix · 6.14.6 CWE-532

TI-2019-12557 CVE-2019-16777 · GHSA-4328-8hgf-7wjr

Arbitrary File Overwrite in npm CLI

LOW 38

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.02043 Published 2019-12-13 Partial fix · 6.13.4 CWE-22

TI-2019-12556 CVE-2019-16776 · GHSA-x8qc-rrcw-4r46

Unauthorized File Access in npm CLI before before version 6.13.3

MEDIUM 41

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.03412 Published 2019-12-13 Partial fix · 6.13.3 CWE-22

TI-2019-12555 CVE-2019-16775 · GHSA-m6cx-g6qm-p2cx

Unauthorized File Access in npm CLI before before version 6.13.3

LOW 39

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.02897 Published 2019-12-13 Partial fix · 6.13.3 CWE-61

TI-2018-05346 CVE-2018-7408 · GHSA-ph34-pc88-72gc

An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0"…

LOW 34

An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.0032 Published 2018-02-22 Fixed in 5.7.1 CWE-732

TI-2016-03362 CVE-2016-3956 · GHSA-m5h6-hr3q-22h5

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before…

MEDIUM 41

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTT…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05456 Published 2016-07-02 Partial fix · 2.15.1, 3.8.3 CWE-200

Vulnerabilities

Filters