CVE-2017-18869

Time-of-check Time-of-use (TOCTOU) Race Condition in chownr

2.5 LowFix available

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.33%Down 0.2 points since Apr 14, 2021

What each source reports

NVD Score used 2.5

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Record: CVE-2017-18869
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0: 1.9 LowAV:L/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-367
Updated: 2026-11-02

CVE List No score

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Record: CVE-2017-18869
Updated: 2026-11-02

EUVDEUVD-2022-0956 No score

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Record: EUVD-2022-0956
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c6rq-rjc2-86v2 2.5

Time-of-check Time-of-use (TOCTOU) Race Condition in chownr

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Record: GHSA-c6rq-rjc2-86v2
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-367
Updated: 2026-11-02

OSV 2.5

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Record: CVE-2017-18869
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-18869 2.5

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Record: DEBIAN-CVE-2017-18869
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

Show 6 moreShow less

OSVGHSA-c6rq-rjc2-86v2 2.5

Time-of-check Time-of-use (TOCTOU) Race Condition in chownr

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Record: GHSA-c6rq-rjc2-86v2
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-367
Updated: 2026-11-02

OSVRHSA-2020:2625 7.7

Red Hat Security Advisory: rh-nodejs8-nodejs security update

Record: RHSA-2020:2625
CVSS 3.0: 7.7 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-18869 2.5

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Record: UBUNTU-CVE-2017-18869
CVSS 3.1: 2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVCLSA-2026-1772669620 No score

TuxCare security update for chownr (1 CVE)

TuxCare rebuilt chownr to address 1 CVE. Fixed in 1.0.1-tuxcare.1.

Record: CLSA-2026-1772669620
Updated: 2026-11-02

OSVCLSA-2026-1773706634 No score

TuxCare security update for chownr (1 CVE)

TuxCare rebuilt chownr to address 1 CVE. Fixed in 0.0.2-tuxcare.1.

Record: CLSA-2026-1773706634
Updated: 2026-11-02

OSVMGASA-2021-0169 No score

Updated nodejs-chownr packages fix security vulnerability

Updated nodejs-chownr package fixes security vulnerability:

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks (CVE-2017-18869).

Record: MGASA-2021-0169
Updated: 2026-11-02

Affected products

chownr project chownr

Affected packages

Affected packages
Package	Affected	Fixed
`chownr` npm	before 1.1.0	1.1.0
`chownr` TuxCare:npm	1.0.1-tuxcare.0 up to 1.0.1-tuxcare.1, plus listed versions 1.0.1	1.0.1-tuxcare.1
`chownr` TuxCare:npm	0.0.2-tuxcare.0 up to 0.0.2-tuxcare.1, plus listed versions 0.0.2	0.0.2-tuxcare.1
`node-chownr` Debian:12	before 1.1.1-1	1.1.1-1
`node-chownr` Debian:13	before 1.1.1-1	1.1.1-1
`node-chownr` Debian:14	before 1.1.1-1	1.1.1-1
`nodejs-chownr` Mageia:7	before 1.1.0-1.mga7	1.1.0-1.mga7
`rh-nodejs8-nodejs` Red Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs	before 0:8.17.0-2.el7	0:8.17.0-2.el7
`rh-nodejs8-nodejs-debuginfo` Red Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs	before 0:8.17.0-2.el7	0:8.17.0-2.el7
`rh-nodejs8-nodejs-devel` Red Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs	before 0:8.17.0-2.el7	0:8.17.0-2.el7

Show 8 moreShow less

Affected packages
Package	Affected	Fixed
`rh-nodejs8-nodejs-docs` Red Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs	before 0:8.17.0-2.el7	0:8.17.0-2.el7
`rh-nodejs8-npm` Red Hat:rhel_software_collections:3::el7 From an advisory covering 7 CVEs	before 0:6.13.4-8.17.0.2.el7	0:6.13.4-8.17.0.2.el7
`node-chownr` Ubuntu:20.04:LTS	All versions, plus listed versions 1.1.1-11.1.3-3	None known
`node-chownr` Ubuntu:22.04:LTS	All versions, plus listed versions 1.1.3-52.0.0-1	None known
`node-chownr` Ubuntu:24.04:LTS	All versions, plus listed versions 2.0.0-2	None known
`node-chownr` Ubuntu:25.10	All versions, plus listed versions 2.0.0-3	None known
`node-chownr` Ubuntu:26.10	All versions, plus listed versions 3.0.0-23.0.0-4	None known
`node-chownr` Ubuntu:26.04:LTS	All versions, plus listed versions 2.0.0-33.0.0-2	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-18869 is a low vulnerability (CVSS 2.5) in Chownr Project Chownr, published June 15, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in chownr 1.1.0.

References

Show 39 moreShow less