GitHub Advisoryadvisory · npm

GHSA-c6rq-rjc2-86v2 Time-of-check Time-of-use (TOCTOU) Race Condition in chownr

LOW Published 2022-02-10 Modified 2021-05-12 Official page ↗
Aliases
CVE-2017-18869
Ecosystem
npm
Packages
chownr
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-367
Reviewed
2021-05-12

Affected packages

• npm chownr: < 1.1.0 → fixed in 1.1.0

Description

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Related

Alias · CVE (1)

  • CVE-2017-18869 A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into… vulnerability

Weakness · CWE (1)

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References