CVE-2019-5484
Symlink Arbitrary File Overwrite in bower
Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted.
- Record
CVE-2019-5484- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted.
- Record
CVE-2019-5484- Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2019-0674 No score
Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted.
- Record
EUVD-2019-0674- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p6mr-pxg4-68hx
Symlink Arbitrary File Overwrite in bower
Versions of bower prior to 1.8.8 are affected by an arbitrary file write vulnerability. The vulnerability occurs because bower does not verify that extracted symbolic links do not resolve to targets outside of the extraction root directory.
Recommendation
Update to version 1.8.8 or later
- Record
GHSA-p6mr-pxg4-68hx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted.
- Record
CVE-2019-5484- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-p6mr-pxg4-68hx
Symlink Arbitrary File Overwrite in bower
Versions of bower prior to 1.8.8 are affected by an arbitrary file write vulnerability. The vulnerability occurs because bower does not verify that extracted symbolic links do not resolve to targets outside of the extraction root directory.
Recommendation
Update to version 1.8.8 or later
- Record
GHSA-p6mr-pxg4-68hx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVCLSA-2026-1782176268 No score
TuxCare security update for bower (1 CVE)
TuxCare rebuilt bower to address 1 CVE. Fixed in 1.8.4-tuxcare.1.
- Record
CLSA-2026-1782176268- Updated
- 2026-11-02
OSVCLSA-2026-1792163513 No score
TuxCare security update for bower (1 CVE)
TuxCare rebuilt bower to address 1 CVE. Fixed in 1.8.7-tuxcare.1.
- Record
CLSA-2026-1792163513- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-5484 is a high vulnerability (CVSS 7.5) in Bower, published September 13, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.57%, the 85th percentile. Fixed in bower 1.8.8.
References
hackerone.com/reports/473811
snyk.io/blog/severe-security-vulnerability-in-bowers-zip-archive-extraction
github.com/bower/bower/commit/45c6bfa86f6e57731b153baca9e0b41a1cc699e3
lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2019-5484
Show 5 moreShow less
npmjs.com/advisories/776