Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The assertPath guard added to tmp@0.2.6 rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.prototype.join/String coercion inside generateTmpName and path.join(tmpDir, opts.dir, name), producing a final path that escapes tmpdir and creates a file or directory at an attacker-controlled location with the host process's privileges. This affects any application that forwards untrusted request data (a common pattern is JSON body fields or qs-parsed bracket-array query strings such as ?prefix[]=...) into tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync without explicit type coercion. Impact - Arbitrary file creation outside the intended temporary directory, with the running process's filesystem permissions. - Directory…
Recommended action: Upgrade to 0.2.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. Details Root Cause: The vulnerability exists in tmp's path construction logic where user-supplied options are directly concatenated into file paths without sanitization or validation. Technical Flow: 1. Filename Construction: tmp builds filenames as <prefix-<pid-<random-<postfix 2. Path Composition: Final path computed as path.join(tmpDir, opts.dir, name) 3. Path Normalization: Node.js path.join()…
Recommended action: Upgrade to 0.2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
tmp@0.2.3 is vulnerable to an Arbitrary temporary file / directory write via symbolic link dir parameter. Details According to the documentation there are some conditions that must be held: Related issue: https://github.com/raszi/node-tmp/issues/207. The issue occurs because resolvePath does not properly handle symbolic link when resolving paths: If the dir parameter points to a symlink that resolves to a folder outside the tmpDir, it's possible to bypass the assertIsRelative check used in assertAndSanitizeOptions: PoC The following PoC demonstrates how writing a tmp file on a folder outside the tmpDir is possible. Tested on a Linux machine. - Setup: create a symbolic link inside the tmpDir that points to a directory outside of it - check the folder is empty: - run the poc - the temporary file is created under $HOME/mydir1 (outside the tmpDir): - main.js A Potential fix could be to call fs.realpathSync (or similar) that resolves also symbolic links. Impact Arbitrary temporary…
Recommended action: Upgrade to 0.2.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.