Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2019-16775

24
FAUCET Score

CVE-2019-16775 is an arbitrary file write vulnerability affecting npm CLI versions prior to 6.13.3, impacting products like Fedora, npmjs, and Red Hat. Attackers can exploit this by crafting a malicious package.json bin field, allowing them to create symlinks to arbitrary files outside the node_modules folder during package installation, even bypassing the --ignore-scripts option. This medium-severity vulnerability (CVSS 6.5) has a low attack complexity and can lead to high integrity impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
8.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
8.1CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
< 6.13.3CPE matchmatch criteria
cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:*
15.1CPE matchmatch criteria
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
19.3.0.2CPE matchmatch criteria
cpe:2.3:a:oracle:graalvm:19.3.0.2:*:*:*:enterprise:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.7HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
1.3
Impact Score
5.8
CvssVersion
3.1

Exploit Intelligence

EPSS Score
3.33%
Probability of exploitation in next 30 days
EPSS Percentile
87.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0333 is in the 96th percentile among its peer group of 21,951 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (15)

npmpatch availablevia ghsa
Product: npmFixed in: 6.13.3
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: nodejs:12-8010020200116150415.c27ad7f8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: nodejs:10-8010020200213140254.c27ad7f8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.0 Update Services for SAP SolutionsFixed in: nodejs:10-8000020200214110450.f8e95b4e
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-nodejs10-nodejs-0:10.19.0-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-nodejs12-nodejs-0:12.16.1-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-nodejs8-nodejs-0:8.17.0-2.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: rh-nodejs10-nodejs-0:10.19.0-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: rh-nodejs12-nodejs-0:12.16.1-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-nodejs10-nodejs-0:10.19.0-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-nodejs12-nodejs-0:12.16.1-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-nodejs8-nodejs-0:8.17.0-2.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-nodejs10-nodejs-0:10.19.0-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-nodejs12-nodejs-0:12.16.1-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-nodejs8-nodejs-0:8.17.0-2.el7
View patch

Vendor Advisories (2)

npmGHSA-m6cx-g6qm-p2cxhigh

Arbitrary File Write in npm

Dec 13, 2019
redhatCVE-2019-16775Low

npm: Symlink reference outside of node_modules folder through the bin field upon installation

Dec 12, 2019

References

lists.opensuse.org / opensuse-security-announce/2020-01/msg00027.html
Mailing ListThird Party Advisory
access.redhat.com / errata/RHEA-2020:0330
Third Party Advisory
access.redhat.com / errata/RHSA-2020:0573
Third Party Advisory
access.redhat.com / errata/RHSA-2020:0579
Third Party Advisory
access.redhat.com / errata/RHSA-2020:0597
Third Party Advisory
access.redhat.com / errata/RHSA-2020:0602
Third Party Advisory
blog.npmjs.org / post/189618601100/binary-planting-with-the-npm-cli
Third Party Advisory
github.com / npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx
Third Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP
oracle.com / security-alerts/cpujan2020.html
Third Party Advisory
oracle.com / security-alerts/cpuoct2021.html
Third Party Advisory