CVE-2021-43616

Name
CVE-2021-43616
Description
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json.
NVD Severity
high
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://docs.npmjs.com/cli/v7/commands/npm-ci
MISC https://github.com/npm/cli/issues/2701
MISC https://github.com/icatalina/CVE-2021-43616

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:* npm >= 7.0.0 <= 7.24.2
cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:* npm >= 8.0.0 <= 8.1.3

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
npm 3.14-main 7.17.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable