{"id":"CVE-2018-7408","details":"An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as \"next: 5.7.0\" and therefore automatically installed by an \"npm upgrade -g npm\" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a \"correctMkdir\" issue.","aliases":["GHSA-ph34-pc88-72gc"],"modified":"2026-07-08T16:07:16.668729Z","published":"2018-02-22T18:29:00.253Z","related":["CGA-f896-4842-p6h5"],"references":[{"type":"ADVISORY","url":"http://blog.npmjs.org/post/171169301000/v571"},{"type":"ADVISORY","url":"https://github.com/npm/npm/commit/74e149da6efe6ed89477faa81fef08eee7999ad0"},{"type":"REPORT","url":"https://github.com/npm/npm/issues/19883"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nodejs/node","events":[{"introduced":"cf317e2181749f71d101718fad30fcce99ae7406"},{"last_affected":"cf317e2181749f71d101718fad30fcce99ae7406"}],"database_specific":{"cpe":"cpe:2.3:a:npmjs:npm:5.7.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.7.0"},{"last_affected":"5.7.0"}],"source":"CPE_STRING"}}],"versions":["5.7.0","v5.7.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-7408.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/npm/cli","events":[{"introduced":"d3095ff20b8ea01e7fbf93a4a697a04fea77d8e6"},{"last_affected":"d3095ff20b8ea01e7fbf93a4a697a04fea77d8e6"}],"database_specific":{"cpe":"cpe:2.3:a:npmjs:npm:5.7.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.7.0"},{"last_affected":"5.7.0"}],"source":"CPE_STRING"}}],"versions":["5.7.0","v5.7.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-7408.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/npm/npm","events":[{"introduced":"d3095ff20b8ea01e7fbf93a4a697a04fea77d8e6"},{"last_affected":"d3095ff20b8ea01e7fbf93a4a697a04fea77d8e6"},{"fixed":"74e149da6efe6ed89477faa81fef08eee7999ad0"}],"database_specific":{"cpe":"cpe:2.3:a:npmjs:npm:5.7.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.7.0"},{"last_affected":"5.7.0"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["5.7.0","v5.7.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-7408.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}