CVE-2021-39134

CVE-2021-39134 is a critical arbitrary file write vulnerability in @npmcli/arborist, the dependency management library for npm, affecting versions 7.20.6 and earlier. This flaw, stemming from case-insensitive filesystem handling of package names and symlinks, allows an attacker to overwrite arbitrary files on a system. With a CVSS score of 7.8 (High), it presents a significant risk of high confidentiality, integrity, and availability impact, requiring user interaction (UI:R) for exploitation. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered community attention and media coverage, indicating its perceived importance.