CVE-2016-10538
Arbitrary File Write in cli
The package node-cli before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The package node-cli before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.
- Record
CVE-2016-10538- CVSS 3.0
- 3.5 Low
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:N/I:P/A:P - Weakness
- CWE-22, CWE-362
- Updated
- 2026-11-02
CVE List No score
The package node-cli before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.
- Record
CVE-2016-10538- Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2019-0240 No score
The package node-cli before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.
- Record
EUVD-2019-0240- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6cpc-mj5c-m9rq No score
Arbitrary File Write in cli
Affected versions of cli use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the cli process has permission to write to.
Proof of Concept
By creating Symbolic Links at the following locations, the target of the link can be written to.
lock_file = '/tmp/' + cli.app + '.pid',
log_file = '/tmp/' + cli.app + '.log';
Recommendation
Update to version 1.0.0 or later.
- Record
GHSA-6cpc-mj5c-m9rq- Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
The package node-cli before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.
- Record
CVE-2016-10538- CVSS 3.0
- 3.5 Low
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-10538
The package node-cli before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.
- Record
UBUNTU-CVE-2016-10538- CVSS 3.0
- 3.5 Low
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1774225194 No score
TuxCare security update for cli (1 CVE)
TuxCare rebuilt cli to address 1 CVE. Fixed in 0.6.6-tuxcare.1.
- Record
CLSA-2026-1774225194- Updated
- 2026-11-02
OSVCLSA-2026-1774225195 No score
TuxCare security update for cli (1 CVE)
TuxCare rebuilt cli to address 1 CVE. Fixed in 0.4.3-tuxcare.1.
- Record
CLSA-2026-1774225195- Updated
- 2026-11-02
OSVCLSA-2026-1789900487 No score
TuxCare security update for cli (1 CVE)
TuxCare rebuilt cli to address 1 CVE. Fixed in 0.4.5-tuxcare.1.
- Record
CLSA-2026-1789900487- Updated
- 2026-11-02
OSVGHSA-6cpc-mj5c-m9rq No score
Arbitrary File Write in cli
Affected versions of cli use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the cli process has permission to write to.
Proof of Concept
By creating Symbolic Links at the following locations, the target of the link can be written to.
lock_file = '/tmp/' + cli.app + '.pid',
log_file = '/tmp/' + cli.app + '.log';
Recommendation
Update to version 1.0.0 or later.
- Record
GHSA-6cpc-mj5c-m9rq- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
clinpm |
before 1.0.0 | 1.0.0 |
cliTuxCare:npm |
0.6.6-tuxcare.0 up to 0.6.6-tuxcare.1, plus listed versions 0.6.6 |
0.6.6-tuxcare.1 |
cliTuxCare:npm |
0.4.3-tuxcare.0 up to 0.4.3-tuxcare.1, plus listed versions 0.4.3 |
0.4.3-tuxcare.1 |
cliTuxCare:npm |
0.4.5-tuxcare.0 up to 0.4.5-tuxcare.1, plus listed versions 0.4.5 |
0.4.5-tuxcare.1 |
node-cliUbuntu:16.04:LTS |
All versions, plus listed versions 0.4.4~20120516-1 |
None known |
node-cliUbuntu:18.04:LTS |
All versions, plus listed versions 0.4.4~20120516-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-10538 is a low vulnerability (CVSS 3.5) in Cli Project Cli, published May 31, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. Fixed in cli 1.0.0.