CVE-2017-18869

CVE-2017-18869 describes a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the chownr package for Node.js 10.10, affecting versions prior to 1.1.0. A local attacker could exploit this by using symlink attacks to manipulate the package into processing unintended directories. With a CVSS score of 2.5 (Low), this vulnerability has a local attack vector and high attack complexity, potentially leading to low integrity impact but no confidentiality or availability impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.