CVE-2013-4116: lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via...

Security readout for executives and security teams

CVE-2013-4116 is a local file-overwrite flaw in npm before 1.3.3. When npm unpacked archives, it used predictable temporary filenames, allowing a local user to abuse symlinks and overwrite files. The business risk is highest on shared systems or where npm ran with elevated privileges. Exposure is likely limited to systems running npm versions before 1.3.3, especially multi-user hosts, build servers, or legacy environments where local users can interact with npm unpacking behavior. Treat as a legacy hygiene issue unless vulnerable npm remains on shared or privileged build infrastructure. Prioritize confirmation and upgrade on any system where local users or CI jobs could influence package unpacking. Mitigation focus: Upgrade npm to 1.3.3 or later where the vulnerable behavior is addressed.; Use vendor package guidance for affected legacy operating system packages.; Avoid running vulnerable npm versions with elevated privileges on shared hosts..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.