Skip to content
fr Sign in
7.0 High

CVE-2026-0775 npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability

Description

npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.

Affected products and versions

Product Affected versions Fixed in
cli 10.9.0 No fix stated
Confidential Compute Attestation Versions not published
Cryostat 4 Versions not published
Logging Subsystem for Red Hat OpenShift Versions not published
Migration Toolkit for Containers Versions not published
Multicluster Engine for Kubernetes Versions not published
Network Observability Operator Versions not published
Node HealthCheck Operator Versions not published
OpenShift Lightspeed Versions not published
Show the 26 other branches
Product Affected versions Fixed in
OpenShift Pipelines Versions not published
OpenShift Serverless Versions not published
Red Hat 3scale API Management Platform 2 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat AMQ Broker 7 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat build of Apache Camel - HawtIO 4 Versions not published
Red Hat Connectivity Link 1 Versions not published
Red Hat Developer Hub Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat OpenShift GitOps Versions not published
Red Hat Quay 3 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Single Sign-On 7 Versions not published
Red Hat Trusted Artifact Signer Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of cli

The 5 CVEs of cli →
CVE-2020-15095 Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files 4.4 Medium CVE-2019-16777 Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite 7.7 High CVE-2019-16776 Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write 7.7 High CVE-2019-16775 Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write 7.7 High
Track this CVE