CVE-2021-39135 (High) detected in arborist-2.7.1.tgz - autoclosed

[mend-for-github-com]

CVE-2021-39135 - High Severity Vulnerability

Vulnerable Library - arborist-2.7.1.tgz

Manage node_modules trees

Library home page: https://registry.npmjs.org/@npmcli/arborist/-/arborist-2.7.1.tgz

Path to dependency file: /npm_and_yarn/helpers/package.json

Path to vulnerable library: /npm_and_yarn/helpers/node_modules/@npmcli/arborist/package.json

Dependency Hierarchy:

• ❌ arborist-2.7.1.tgz (Vulnerable Library)

Found in HEAD commit: ba8cd9078c8ce0cb202767d627706711237abf71

Found in base branch: main

Vulnerability Details

@npmcli/arborist, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project's node_modules folder. If the node_modules folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a node_modules symbolic link would have to be employed. 1. A preinstall script could replace node_modules with a symlink. (This is prevented by using --ignore-scripts.) 2. An attacker could supply the target with a git repository, instructing them to run npm install --ignore-scripts in the root. This may be successful, because npm install --ignore-scripts is typically not capable of making changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see the referenced GHSA-gmw6-94gg-2rc2.

Publish Date: 2021-08-31

URL: CVE-2021-39135

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gmw6-94gg-2rc2

Release Date: 2021-08-31

Fix Resolution: 2.8.2

---

⛑️ Automatic Remediation will be attempted for this issue.

[mend-for-github-com]

✔️ This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

[mend-for-github-com]

ℹ️ This issue was automatically re-opened by WhiteSource because the vulnerable library in the specific branch(es) has been detected in the WhiteSource inventory.

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.