The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
| Link | Tags |
|---|---|
| https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809252 | third party advisory |
| https://github.com/node-js-libs/cli/issues/81 | third party advisory exploit |
| https://nodesecurity.io/advisories/95 | third party advisory exploit |