Description

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Remediation

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863985

https://bugzilla.redhat.com/show_bug.cgi?id=1611614

https://github.com/isaacs/chownr/issues/14

https://snyk.io/vuln/npm:chownr:20180731

Related Vulnerabilities

CVE-2022-22984 Vulnerability in npm package snyk

CVE-2021-33623 Vulnerability in npm package trim-newlines

CVE-2018-8718 Vulnerability in maven package org.jenkins-ci.plugins:mailer

CVE-2017-16224 Vulnerability in npm package st

CVE-2022-25876 Vulnerability in npm package link-preview-js

Severity

Low

Classification

CWE-367 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Third Party Advisory Permissions Required Exploit