CVE-2013-4116
lowpriority · track · 13EPSS 0.004 · 31 %ileEUUSEPSS · scored 2026-10-27
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
- node packaged modules project node packaged modules< 1.3.3nvdUScpe:2.3:a:node_packaged_modules_project:node_packaged_modules:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-v3jv-wrf4-5845Local Privilege Escalation in npm2020-09-01ghsa · osvUS
Affected versions of `npm` use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the `npm` process has permission to write to, potentially resulting in local privilege escalation. ## Recommendation Update to version 1.3.3 or later.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (25)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2013/07/10/17cnnvd
- http://www.openwall.com/lists/oss-security/2013/07/11/9cnnvd
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=715325cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=983917cnnvd
- https://exchange.xforce.ibmcloud.com/vulnerabilities/87141cnnvd
- https://github.com/npm/npm/commit/f4d31693cnnvd
- https://github.com/npm/npm/issues/3635cnnvd
- https://www.npmjs.org/Patchcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan