Description

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Remediation

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863985

https://bugzilla.redhat.com/show_bug.cgi?id=1611614

https://github.com/isaacs/chownr/issues/14

https://snyk.io/vuln/npm:chownr:20180731

Related Vulnerabilities

CVE-2020-2213 Vulnerability in maven package org.jenkins-ci.plugins:whitesource

CVE-2019-5457 Vulnerability in npm package min-http-server

CVE-2017-16129 Vulnerability in maven package org.webjars.npm:superagent

CVE-2016-9177 Vulnerability in maven package com.sparkjava:spark-core

CVE-2021-43571 Vulnerability in npm package starkbank-ecdsa

Severity

Low

Classification

CWE-367 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Tags

Third Party Advisory Permissions Required Exploit