CVE-2019-16776

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
npmcli>= < 6.13.3, < 6.13.3

References

Timeline

Published
Dec 13, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-167776.5Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binarCVE-2019-167789.8In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this cCVE-2019-167795.9In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as bCVE-2019-16784.3A vulnerability in Cisco Meeting Server could allow an authenticated, remote attacker to cause a partial denial of service (DoS) to Cisco MeCVE-2019-167805.4WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is CVE-2019-167815.4In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, whiCVE-2019-167825.9There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 CVE-2019-167847.8In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a softCVE-2019-167857.5Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and heCVE-2019-167867.5Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunkCVE-2019-167898.2In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypassCVE-2019-16795.0A vulnerability in the web interface of Cisco TelePresence Conductor, Cisco Expressway Series, and Cisco TelePresence Video Communication Se
CVE-2019-16776: High severity, CVSS 8.1 | Vulnix