GHSA-3966-F6P6-2QR9高危已审查已撤回

Duplicate Advisory: npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

OSV 1.4.0 · github-reviewed · 修改于 2026-02-07 06:28

发布时间

2026-01-23 14:31

GitHub 审查时间

2026-02-04 01:42

NVD 发布时间

2026-01-23 12:16

源文件

advisories/github-reviewed/2026/01/GHSA-3966-f6p6-2qr9/GHSA-3966-f6p6-2qr9.json

该公告已于 2026-02-07 06:28 撤回

内容仅用于保留外部引用，请不要将其当作仍然有效的安全结论。

公告说明

Duplicate Advisory

This advisory has been withdrawn because describes a dependency bump and therefore, per CVE CNA rule 4.1.12, is a duplicate of GHSA-34x7-hfp2-rc4v/CVE-2026-24842. Additionally, per https://github.com/npm/cli/issues/8939#issuecomment-3862719883, npm cli should not be listed as an affected product. This link is maintained to preserve external references.

Original Description

npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user.

受影响的软件包

npm

标识信息

别名 / CVE

CVE-2026-0775

CWE

CWE-732

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-3966-f6p6-2qr9",
  "aliases": [
    "CVE-2026-0775"
  ],
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because describes a dependency bump and therefore, per [CVE CNA rule 4.1.12](https://www.cve.org/ResourcesSupport/AllResources/CNARules/#section_4-1_Vulnerability_Determination), is a duplicate of GHSA-34x7-hfp2-rc4v/CVE-2026-24842. Additionally, per https://github.com/npm/cli/issues/8939#issuecomment-3862719883, npm cli should not be listed as an affected product. This link is maintained to preserve external references.\n\n### Original Description\nnpm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user.",
  "summary": "Duplicate Advisory: npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "11.8.0"
            }
          ]
        }
      ],
      "package": {
        "name": "npm",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2026-02-06T22:28:42Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "published": "2026-01-23T06:31:24Z",
  "withdrawn": "2026-02-06T22:28:42Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0775",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/npm/cli/issues/8939",
      "type": "WEB"
    },
    {
      "url": "https://github.com/npm/cli",
      "type": "PACKAGE"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-043",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-732"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2026-01-23T04:16:04Z",
    "github_reviewed_at": "2026-02-03T17:42:06Z"
  }
}