CVE-2026-0775
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.
- Record
CVE-2026-0775- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-732, CWE-732
- Updated
- 2026-11-02
EUVDEUVD-2026-4479
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.
- Record
EUVD-2026-4479- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3966-f6p6-2qr9
Duplicate Advisory: npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Duplicate Advisory
This advisory has been withdrawn because describes a dependency bump and therefore, per CVE CNA rule 4.1.12, is a duplicate of GHSA-34x7-hfp2-rc4v/CVE-2026-24842. Additionally, per https://github.com/npm/cli/issues/8939#issuecomment-3862719883, npm cli should not be listed as an affected product. This link is maintained to preserve external references.
Original Description
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user.
- Record
GHSA-3966-f6p6-2qr9- CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-732
- Updated
- 2026-11-02
NVD
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.
- Record
CVE-2026-0775- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-732
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-0775
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.
- Record
DEBIAN-CVE-2026-0775- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-3966-f6p6-2qr9
Duplicate Advisory: npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Duplicate Advisory
This advisory has been withdrawn because describes a dependency bump and therefore, per CVE CNA rule 4.1.12, is a duplicate of GHSA-34x7-hfp2-rc4v/CVE-2026-24842. Additionally, per https://github.com/npm/cli/issues/8939#issuecomment-3862719883, npm cli should not be listed as an affected product. This link is maintained to preserve external references.
Original Description
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user.
- Record
GHSA-3966-f6p6-2qr9- CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-732
- Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-0775
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.
- Record
UBUNTU-CVE-2026-0775- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.0 High
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-0775 No score
CVE-2026-0775 in npm - Patched by Root
Root has patched CVE-2026-0775 in the npm package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-0775- Updated
- 2026-11-02
OSVSUSE-SU-2026:2005-1 No score
Security update for cockpit
This update for cockpit fixes the following issues
- CVE-2026-0775: npm: loading of modules from an unsecured location can be used for local privilege escalation and arbitrary code execution in the context of a target user (bsc#1256521).
- CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI (bsc#1265040).
- CVE-2026-29074: svgo: no guard against entity expansion or recursion when processing XML with custom entities can lead to DoS (bsc#1259290).
- Record
SUSE-SU-2026:2005-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2019-1 No score
Security update for cockpit
This update for cockpit fixes the following issues
- CVE-2026-0775: npm: loading of modules from an unsecured location can be used for local privilege escalation and arbitrary code execution in the context of a target user (bsc#1256521).
- CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI (bsc#1265040).
- CVE-2026-29074: svgo: no guard against entity expansion or recursion when processing XML with custom entities can lead to DoS (bsc#1259290).
- Record
SUSE-SU-2026:2019-1- Updated
- 2026-11-02
Affected products
- cli
- npm cli
- red hat confidential compute attestation
- red hat cryostat 4
- red hat logging subsystem for red hat openshift
- red hat migration toolkit for containers
- red hat multicluster engine for kubernetes
- red hat network observability operator
- red hat node healthcheck operator
- red hat openshift lightspeed
- red hat openshift pipelines
- red hat openshift serverless
Show 24 moreShow less
- red hat 3scale api management platform 2
- red hat advanced cluster management for kubernetes 2
- red hat amq broker 7
- red hat ansible automation platform 2
- red hat build of apache camel - hawtio 4
- red hat connectivity link 1
- red hat developer hub
- red hat enterprise linux 10
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat enterprise linux ai (rhel ai) 3
- red hat fuse 7
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform expansion pack
- red hat openshift ai (rhoai)
- red hat openshift container platform 4
- red hat openshift data foundation 4
- red hat openshift dev spaces
- red hat openshift gitops
- red hat quay 3
- red hat satellite 6
- red hat single sign-on 7
- red hat trusted artifact signer
Affected packages
| Package | Affected | Fixed |
|---|---|---|
npmDebian:12 |
All versions, plus listed versions 11.12.1~ds1-111.12.1~ds1-211.12.1~ds1-311.12.1~ds1-411.13.0~ds1-1 Show 16 moreShow less11.16.0+ds2-111.16.0+ds2-211.16.0+ds2-311.16.0+ds2-411.19.0+ds1-111.19.0+ds1-211.19.0-112.0.2+ds1-112.0.2+ds1-29.2.0~ds1-19.2.0~ds1-29.2.0~ds1-39.2.0~ds1-49.2.0~ds2-19.2.0~ds2-29.2.0~ds3-1 |
None known |
npmDebian:13 |
All versions, plus listed versions 11.12.1~ds1-111.12.1~ds1-211.12.1~ds1-311.12.1~ds1-411.13.0~ds1-1 Show 14 moreShow less11.16.0+ds2-111.16.0+ds2-211.16.0+ds2-311.16.0+ds2-411.19.0+ds1-111.19.0+ds1-211.19.0-112.0.2+ds1-112.0.2+ds1-29.2.0~ds1-39.2.0~ds1-49.2.0~ds2-19.2.0~ds2-29.2.0~ds3-1 |
None known |
npmDebian:14 |
All versions, plus listed versions 11.12.1~ds1-111.12.1~ds1-211.12.1~ds1-311.12.1~ds1-411.13.0~ds1-1 Show 14 moreShow less11.16.0+ds2-111.16.0+ds2-211.16.0+ds2-311.16.0+ds2-411.19.0+ds1-111.19.0+ds1-211.19.0-112.0.2+ds1-112.0.2+ds1-29.2.0~ds1-39.2.0~ds1-49.2.0~ds2-19.2.0~ds2-29.2.0~ds3-1 |
None known |
npmRoot:npm |
before 10.9.8-aikido.1 | 10.9.8-aikido.16.14.18-aikido.1 |
@rootio/npmRoot:npm |
before 10.9.3-root.io.1 | 10.9.3-root.io.110.9.3-root.io.211.6.2-root.io.110.9.8-root.io.16.14.18-root.io.1 |
npmUbuntu:14.04:LTS |
All versions, plus listed versions 1.2.18~dfsg-31.3.10~dfsg-1 |
None known |
npmUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.4.21+ds-23.5.2-0ubuntu43.5.2-0ubuntu4.1.16.04.1~esm1 |
None known |
npmUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.5.2-0ubuntu43.5.2-0ubuntu4.1.18.04.1~esm1 |
None known |
npmUbuntu:20.04:LTS |
All versions, plus listed versions 5.8.0+ds6-46.14.4+ds-1ubuntu2 |
None known |
npmUbuntu:22.04:LTS |
All versions, plus listed versions 7.5.2+ds-27.24.2+ds-17.24.2+ds-28.3.0~ds-18.3.0~ds-28.3.2~ds-18.5.0~ds-18.5.1~ds-1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
npmUbuntu:24.04:LTS |
All versions, plus listed versions 9.2.0~ds1-19.2.0~ds1-2 |
None known |
npmUbuntu:25.10 |
All versions, plus listed versions 9.2.0~ds1-3 |
None known |
npmUbuntu:26.10 |
All versions, plus listed versions 9.2.0~ds3-111.16.0+ds2-4 |
None known |
npmUbuntu:26.04:LTS |
All versions, plus listed versions 9.2.0~ds1-39.2.0~ds2-29.2.0~ds3-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-0775 is a high vulnerability (CVSS 7.0) in Cli, published January 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. Fixed in npm 10.9.8-aikido.1.
References
zerodayinitiative.com/advisories/ZDI-26-043
access.redhat.com/security/cve/CVE-2026-0775
bugzilla.redhat.com/show_bug.cgi?id=2432280
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0775.json
nvd.nist.gov/vuln/detail/CVE-2026-0775
github.com/npm/cli/issues/8939
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2026-0775
suse.com/support/update/announcement/2026/suse-su-20262005-1
bugzilla.suse.com/1256521
ubuntu.com/security/CVE-2026-0775
cve.org/CVERecord?id=CVE-2026-0775