Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2019-16775

UNIX Symbolic Link (Symlink) Following

Published: Dec 13, 2019 | Modified: Nov 21, 2024
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:N/I:P/A:N
RedHat/V2
RedHat/V3
4.8 LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2019-16775
CWEhttps://cwe.mitre.org/data/definitions/61.html

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a users system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the –ignore-scripts install option.

Weakness

The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Affected Software

NameVendorStart VersionEnd Version
Enterprise_linuxRedhat8.0 (including)8.0 (including)
Enterprise_linux_eusRedhat8.1 (including)8.1 (including)
Red Hat Enterprise Linux 8RedHatnodejs:12-8010020200116150415.c27ad7f8*
Red Hat Enterprise Linux 8RedHatnodejs:10-8010020200213140254.c27ad7f8*
Red Hat Enterprise Linux 8.0 Update Services for SAP SolutionsRedHatnodejs:10-8000020200214110450.f8e95b4e*
Red Hat Software Collections for Red Hat Enterprise Linux 7RedHatrh-nodejs10-nodejs-0:10.19.0-1.el7*
Red Hat Software Collections for Red Hat Enterprise Linux 7RedHatrh-nodejs12-nodejs-0:12.16.1-1.el7*
Red Hat Software Collections for Red Hat Enterprise Linux 7RedHatrh-nodejs8-nodejs-0:8.17.0-2.el7*
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSRedHatrh-nodejs10-nodejs-0:10.19.0-1.el7*
Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSRedHatrh-nodejs12-nodejs-0:12.16.1-1.el7*
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSRedHatrh-nodejs10-nodejs-0:10.19.0-1.el7*
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSRedHatrh-nodejs12-nodejs-0:12.16.1-1.el7*
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSRedHatrh-nodejs8-nodejs-0:8.17.0-2.el7*
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSRedHatrh-nodejs10-nodejs-0:10.19.0-1.el7*
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSRedHatrh-nodejs12-nodejs-0:12.16.1-1.el7*
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSRedHatrh-nodejs8-nodejs-0:8.17.0-2.el7*
NpmUbuntubionic*
NpmUbuntudisco*
NpmUbuntueoan*
NpmUbuntufocal*
NpmUbuntugroovy*
NpmUbuntuhirsute*
NpmUbuntuimpish*
NpmUbuntukinetic*
NpmUbuntulunar*
NpmUbuntumantic*
NpmUbuntuoracular*
NpmUbuntuplucky*
NpmUbuntutrusty*
NpmUbuntutrusty/esm*
NpmUbuntuxenial*

Potential Mitigations

  • Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use