CVE-2026-0775
High · 7.0CVSS
7.0
EPSS
0.3%
Published
Jan 23, 2026
CISA due date
—
The record
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | npm | 0 | No fix |
| Chainguard | actions-runner | 0 | 2.331.0-r3 |
| Chainguard | code-server | 0 | 4.106.3-r4 |
| Chainguard | gitlab-rails-ce-assets-18.1 | 0 | 18.1.6-r6 |
| Chainguard | gitlab-rails-ce-assets-18.2 | 0 | 18.2.8-r3 |
| Chainguard | gitlab-rails-ce-assets-18.3 | 0 | 18.3.6-r2 |
| Chainguard | gitlab-rails-ce-assets-18.4 | 0 | 18.4.6-r1 |
| Chainguard | gitlab-rails-ce-assets-18.5 | 0 | 18.5.5-r0 |
| Chainguard | gitlab-rails-ce-assets-18.6 | 0 | 18.6.5-r0 |
| Chainguard | gitlab-rails-ce-assets-18.7 | 0 | 18.7.3-r0 |
| Chainguard | gitlab-rails-ce-assets-18.8 | 0 | 18.8.3-r0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.1 | 0 | 18.1.6-r5 |
| Chainguard | gitlab-rails-ce-assets-fips-18.2 | 0 | 18.2.8-r4 |
| Chainguard | gitlab-rails-ce-assets-fips-18.3 | 0 | 18.3.6-r2 |
| Chainguard | gitlab-rails-ce-assets-fips-18.4 | 0 | 18.4.6-r1 |
| Chainguard | gitlab-rails-ce-assets-fips-18.6 | 0 | 18.6.5-r0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.7 | 0 | 18.7.3-r0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.8 | 0 | 18.8.3-r0 |
| Chainguard | graalvm-24-ce-nodejs | 0 | 24.0.2-r8 |
| Chainguard | graalvm-25-ce-nodejs | 0 | 25.0.2-r1 |
| Chainguard | npm | 0 | 11.9.0-r0 |
| Chainguard | renovate | 0 | 43.3.1-r0 |
| Chainguard | saf | 0 | 1.5.3-r1 |
| Chainguard | vitess-21 | 0 | 21.0.6-r3 |
| Chainguard | vitess-22 | 0 | 22.0.3-r0 |
| Chainguard | vitess-23 | 0 | 23.0.1-r0 |
| Wolfi | code-server | 0 | 4.106.3-r4 |
| Wolfi | npm | 0 | 11.9.0-r0 |
| Wolfi | renovate | 0 | 43.3.1-r0 |
| Wolfi | saf | 0 | 1.5.3-r1 |
| Wolfi | vitess-21 | 0 | 21.0.6-r3 |
| Wolfi | vitess-22 | 0 | 22.0.3-r0 |
| Wolfi | vitess-23 | 0 | 23.0.1-r0 |
Related vulnerabilities
- GHSA-3966-f6p6-2qr9 Duplicate Advisory: npm cli Uncontrolled Search Path Element Local Privilege Escalation… Same vulnerability
- CVE-2016-3956 The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before… Also affects npm
- GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath Also affects actions-runner
- CVE-2026-31802 node-tar is a full-featured Tar for Node.js. Also affects actions-runner
- CVE-2026-29786 node-tar is a full-featured Tar for Node.js. Also affects actions-runner
- GHSA-qffp-2rhf-9h96 tar has Hardlink Path Traversal via Drive-Relative Linkpath Also affects actions-runner
- GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent… Also affects actions-runner
- GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular… Also affects actions-runner