cve/2019/CVE-2019-16775.md

### [CVE-2019-16775](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16775)
![](https://img.shields.io/static/v1?label=Product&message=cli&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%206.13.3%3C%206.13.3%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-61%3A%20UNIX%20Symbolic%20Link%20(Symlink)%20Following&color=brighgreen)

### Description

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

### POC

#### Reference
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Live-Hack-CVE/CVE-2019-16775