GHSA-3mrp-qhcj-mwv5
Suggest an improvement- Source
- https://github.com/advisories/GHSA-3mrp-qhcj-mwv5
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-3mrp-qhcj-mwv5/GHSA-3mrp-qhcj-mwv5.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-3mrp-qhcj-mwv5
- Aliases
-
- CVE-2016-1000021
- Withdrawn
- 2023-12-08T21:57:37Z
- Published
- 2022-05-24T17:02:32Z
- Modified
- 2026-09-10T03:49:19Z
- Severity
-
- 3.5 (Low) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- Duplicate Advisory: Node CLI Allows Arbitrary File Overwrite
- Details
-
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6cpc-mj5c-m9rq. This link is maintained to preserve external references.
Original Description
An issue exists in node-cli 0.1.0 through 0.11.3 due to predictable temporary file names in lock_file and log_file, which allows an attacker to overwrite files.
- Database specific
{ "cwe_ids": [ "CWE-22" ], "github_reviewed": true, "github_reviewed_at": "2023-07-28T18:34:12Z", "nvd_published_at": "2019-12-03T22:15:00Z", "severity": "LOW" }- References
Affected packages
npm / cli
Package
- Name
- cli
- View open source insights on deps.dev
- Purl
- pkg:npm/cli