CVE-2021-39135

CVE-2021-39135 is a high-severity vulnerability in @npmcli/arborist, the dependency management library for the npm CLI, affecting npmjs, Oracle, and Siemens products. It allows an attacker to write arbitrary files to the file system by replacing a project's node_modules folder with a symbolic link, which can be achieved via a preinstall script or by tricking a user into running npm install --ignore-scripts on a malicious Git repository. The vulnerability has a CVSS score of 7.8 (High), indicating a low attack complexity and high impact on confidentiality, integrity, and availability, requiring user interaction. There is no evidence of active exploitation, public exploit code, or inclusion in CISA's KEV catalog, but it has garnered significant community discussion and media coverage.