Vulnerability record · CVE-2018-7408 · published 22 February 2018

CVE-2018-7408: Npmjs npm incorrect permission assignment vulnerability

Npmjs · Npm

An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue.

7.8 CVSS 3.0 High EPSS 0.32% · top 77.2% CWE-732 · Incorrect permission assignment

7.8CVSS 3.0 base score, v2 4.6

0.32%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Npm Npmjs

References

Link	Tags
http://blog.npmjs.org/post/171169301000/v571	Vendor Advisory
https://github.com/npm/npm/commit/74e149da6efe6ed89477faa81fef08eee7999ad0	Third Party Advisory
https://github.com/npm/npm/issues/19883	Issue TrackingThird Party Advisory
http://blog.npmjs.org/post/171169301000/v571	Vendor Advisory
https://github.com/npm/npm/commit/74e149da6efe6ed89477faa81fef08eee7999ad0	Third Party Advisory
https://github.com/npm/npm/issues/19883	Issue TrackingThird Party Advisory

Track CVE-2018-7408 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-43616Npmjs npm insufficient verification of data authenticity vulnerabilityThe npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from pa…EPSS 2.7%13 Nov 2021 8.1CVE-2019-16776Npmjs npm path traversal vulnerabilityVersions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node…EPSS 3.4%13 Dec 2019 7.5CVE-2022-29244Npmjs npm information exposure vulnerabilitynpm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`,…EPSS 3.9%13 Jun 2022 7.5CVE-2016-3956Ibm sdk information exposure vulnerabilityThe CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, …EPSS 6.7%2 Jul 2016 6.5CVE-2019-16777Npmjs npm path traversal vulnerabilityVersions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be…EPSS 2.1%13 Dec 2019 6.5CVE-2019-16775Redhat enterprise linux link following vulnerabilityVersions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of…EPSS 3.3%13 Dec 2019 4.4CVE-2020-15095Npmjs npm sensitive information in log file vulnerabilityVersions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<proto…EPSS 0.40%7 Jul 2020 4.3CVE-2018-13374FortiOS and FortiADC access control flaw exposes LDAP credentialsFortiOS (6.0.2, 5.6.7 and earlier) and FortiADC (6.1.0, 6.0.0-6.0.1, 5.4.0-5.4.4) contain an improper access control flaw. An attacker can redirect a…KEVEPSS 38%analysed22 Jan 2019

Source: NIST National Vulnerability Database (record CVE-2018-7408), CISA KEV, FIRST EPSS (scores of 2026-10-05). This page is refreshed as NVD updates the record.