Unrated

DEBIAN-CVE-2026-0775

Type: advisorySource: OSV1 source record

npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.

Announced 23 Jan 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-0775

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-0775

npm

Source reference: /affected/0/package/name

Affected versions: 11.12.1~ds1-1
Source reference: /affected/0/versions
11.12.1~ds1-2
Source reference: /affected/0/versions
11.12.1~ds1-3
Source reference: /affected/0/versions
11.12.1~ds1-4
Source reference: /affected/0/versions
11.13.0~ds1-1
Source reference: /affected/0/versions
11.16.0+ds2-1
Source reference: /affected/0/versions
11.16.0+ds2-2
Source reference: /affected/0/versions
11.16.0+ds2-3
Source reference: /affected/0/versions
11.16.0+ds2-4
Source reference: /affected/0/versions
11.19.0+ds1-1
Source reference: /affected/0/versions
11.19.0+ds1-2
Source reference: /affected/0/versions
11.19.0-1
Source reference: /affected/0/versions
12.0.2+ds1-1
Source reference: /affected/0/versions
12.0.2+ds1-2
Source reference: /affected/0/versions
9.2.0~ds1-1
Source reference: /affected/0/versions
9.2.0~ds1-2
Source reference: /affected/0/versions
9.2.0~ds1-3
Source reference: /affected/0/versions
9.2.0~ds1-4
Source reference: /affected/0/versions
9.2.0~ds2-1
Source reference: /affected/0/versions
9.2.0~ds2-2
Source reference: /affected/0/versions
9.2.0~ds3-1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

npm

Source reference: /affected/1/package/name

Affected versions: 11.12.1~ds1-1
Source reference: /affected/1/versions
11.12.1~ds1-2
Source reference: /affected/1/versions
11.12.1~ds1-3
Source reference: /affected/1/versions
11.12.1~ds1-4
Source reference: /affected/1/versions
11.13.0~ds1-1
Source reference: /affected/1/versions
11.16.0+ds2-1
Source reference: /affected/1/versions
11.16.0+ds2-2
Source reference: /affected/1/versions
11.16.0+ds2-3
Source reference: /affected/1/versions
11.16.0+ds2-4
Source reference: /affected/1/versions
11.19.0+ds1-1
Source reference: /affected/1/versions
11.19.0+ds1-2
Source reference: /affected/1/versions
11.19.0-1
Source reference: /affected/1/versions
12.0.2+ds1-1
Source reference: /affected/1/versions
12.0.2+ds1-2
Source reference: /affected/1/versions
9.2.0~ds1-3
Source reference: /affected/1/versions
9.2.0~ds1-4
Source reference: /affected/1/versions
9.2.0~ds2-1
Source reference: /affected/1/versions
9.2.0~ds2-2
Source reference: /affected/1/versions
9.2.0~ds3-1
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

npm

Source reference: /affected/2/package/name

Affected versions: 11.12.1~ds1-1
Source reference: /affected/2/versions
11.12.1~ds1-2
Source reference: /affected/2/versions
11.12.1~ds1-3
Source reference: /affected/2/versions
11.12.1~ds1-4
Source reference: /affected/2/versions
11.13.0~ds1-1
Source reference: /affected/2/versions
11.16.0+ds2-1
Source reference: /affected/2/versions
11.16.0+ds2-2
Source reference: /affected/2/versions
11.16.0+ds2-3
Source reference: /affected/2/versions
11.16.0+ds2-4
Source reference: /affected/2/versions
11.19.0+ds1-1
Source reference: /affected/2/versions
11.19.0+ds1-2
Source reference: /affected/2/versions
11.19.0-1
Source reference: /affected/2/versions
12.0.2+ds1-1
Source reference: /affected/2/versions
12.0.2+ds1-2
Source reference: /affected/2/versions
9.2.0~ds1-3
Source reference: /affected/2/versions
9.2.0~ds1-4
Source reference: /affected/2/versions
9.2.0~ds2-1
Source reference: /affected/2/versions
9.2.0~ds2-2
Source reference: /affected/2/versions
9.2.0~ds3-1
Source reference: /affected/2/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "npm",
      "purl": "pkg:deb/debian/npm?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "11.12.1~ds1-1",
      "11.12.1~ds1-2",
      "11.12.1~ds1-3",
      "11.12.1~ds1-4",
      "11.13.0~ds1-1",
      "11.16.0+ds2-1",
      "11.16.0+ds2-2",
      "11.16.0+ds2-3",
      "11.16.0+ds2-4",
      "11.19.0+ds1-1",
      "11.19.0+ds1-2",
      "11.19.0-1",
      "12.0.2+ds1-1",
      "12.0.2+ds1-2",
      "9.2.0~ds1-1",
      "9.2.0~ds1-2",
      "9.2.0~ds1-3",
      "9.2.0~ds1-4",
      "9.2.0~ds2-1",
      "9.2.0~ds2-2",
      "9.2.0~ds3-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-0775.json"
    },
    "ecosystem_specific": {
      "urgency": "unimportant"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "npm",
      "purl": "pkg:deb/debian/npm?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "11.12.1~ds1-1",
      "11.12.1~ds1-2",
      "11.12.1~ds1-3",
      "11.12.1~ds1-4",
      "11.13.0~ds1-1",
      "11.16.0+ds2-1",
      "11.16.0+ds2-2",
      "11.16.0+ds2-3",
      "11.16.0+ds2-4",
      "11.19.0+ds1-1",
      "11.19.0+ds1-2",
      "11.19.0-1",
      "12.0.2+ds1-1",
      "12.0.2+ds1-2",
      "9.2.0~ds1-3",
      "9.2.0~ds1-4",
      "9.2.0~ds2-1",
      "9.2.0~ds2-2",
      "9.2.0~ds3-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-0775.json"
    },
    "ecosystem_specific": {
      "urgency": "unimportant"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "npm",
      "purl": "pkg:deb/debian/npm?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "11.12.1~ds1-1",
      "11.12.1~ds1-2",
      "11.12.1~ds1-3",
      "11.12.1~ds1-4",
      "11.13.0~ds1-1",
      "11.16.0+ds2-1",
      "11.16.0+ds2-2",
      "11.16.0+ds2-3",
      "11.16.0+ds2-4",
      "11.19.0+ds1-1",
      "11.19.0+ds1-2",
      "11.19.0-1",
      "12.0.2+ds1-1",
      "12.0.2+ds1-2",
      "9.2.0~ds1-3",
      "9.2.0~ds1-4",
      "9.2.0~ds2-1",
      "9.2.0~ds2-2",
      "9.2.0~ds3-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-0775.json"
    },
    "ecosystem_specific": {
      "urgency": "unimportant"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #55384 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 15:48:19 GMT
Publisher date: Fri, 23 Jan 2026 04:16:04 GMT

Read the original announcement