CVE-2026-0775

npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability

View on CVE.org
Published Jan 23, 2026 CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Description
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-3966-f6p6-2qr9 Duplicate Advisory: npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
History
Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Npm
Npm npm
Vendors & Products Npm
Npm npm
Type Values Removed Values Added
Description npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.
Title npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability
Weaknesses CWE-732
References
Metrics cvssV3_0

{'score': 7, 'vector': 'CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
zdi
Published
Updated
Jul 15, 2026, 1:24 AM
Reserved
Jan 8, 2026, 10:50 PM

View source JSON

Updated
Jun 30, 2026, 12:07 PM

JSON

Status
Deferred
Published
Jan 23, 2026, 4:16 AM
Modified
Jul 15, 2026, 2:17 AM

View source JSON

Severity
Important
Public date
Jan 23, 2026, 3:29 AM

View source Bugzilla JSON

Updated
Apr 18, 2026, 3:30 PM

JSON