GitHub Advisoryadvisory · npm

GHSA-xf7w-r453-m56c Arbitrary File Overwrite in fstream

HIGH Published 2019-05-30 Modified 2021-08-04 Official page ↗
Aliases
CVE-2019-13173
Ecosystem
npm
Packages
fstream
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-59
Reviewed
2019-05-30

Affected packages

• npm fstream: < 1.0.12 → fixed in 1.0.12

Description

Versions of `fstream` prior to 1.0.12 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file. The `fstream.DirWriter()` function is vulnerable. Recommendation Upgrade to version 1.0.12 or later.

Related

Alias · CVE (1)

  • CVE-2019-13173 fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References