CVSS: 8.2EPSS: 0%CPEs: 5EXPL: 0CVE-2021-39135 – UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
https://notcve.org/view.php?id=CVE-2021-39135
31 Aug 2021 — `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, ... • https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-61: UNIX Symbolic Link (Symlink) Following •
CVSS: 8.2EPSS: 1%CPEs: 5EXPL: 0CVE-2021-39134 – UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
https://notcve.org/view.php?id=CVE-2021-39134
31 Aug 2021 — `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is, in part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies. When multi... • https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf • CWE-61: UNIX Symbolic Link (Symlink) Following CWE-178: Improper Handling of Case Sensitivity •