CVE-2021-39134

A flaw was found in nodejs-arborist. On case-insensitive file systems (such as macOS and Windows), Arborist’s internal data structure did not see multiple dependencies as separate items that could coexist within the same level in the node_modules hierarchy when they differ only in the case of their name. This issue, combined with a symlink dependency such as file:/some/path, allows an attacker to create a situation in which arbitrary contents are written to any location on the filesystem. The highest threat from this vulnerability is to integrity and system availability.

Anyone using npm v7.20.6 or earlier on a case-insensitive filesystem is potentially affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.