Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2019-13173

fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2019-13173
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 10:34 UTC · Revision 1

Source evidence

CVE-2019-13173

core-osv · Original source

Published 2 Jul 2019, 20:15 UTC

fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.

osv:CVE-2019-13173
Complete source record
{
  "id": "2fb20ab059efa905d3d157c095d030be595f925e24b1c9d14566ff5283c355e1",
  "url": "https://osv.dev/vulnerability/CVE-2019-13173",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2019-13173",
    "summary": "fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.",
    "evidence": "osv:CVE-2019-13173",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2019-13173",
      "aliases": [
        "CVE-2019-13173",
        "GHSA-xf7w-r453-m56c"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/npm/fstream",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "42354590e23bb514eb5c869eea64406be2947c6c"
                },
                {
                  "fixed": "6a77d2fa6e1462693cf8e46f930da96ec1b0bb22"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:fstream_project:fstream:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.0.12"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "6a77d2fa6e1462693cf8e46f930da96ec1b0bb22"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.0.11",
            "v1.0.10",
            "v1.0.9",
            "v1.0.8",
            "v1.0.7",
            "v1.0.6",
            "v1.0.5",
            "v1.0.4",
            "v1.0.3",
            "v1.0.2",
            "v1.0.1",
            "v0.1.30",
            "v1.0.0",
            "v0.1.29",
            "v0.1.28",
            "v0.1.27",
            "v0.1.26",
            "v0.1.25",
            "v0.1.24",
            "v0.1.23",
            "v0.1.22",
            "v0.1.21",
            "v0.1.20",
            "v0.1.19",
            "0.1.18",
            "0.1.17",
            "0.1.16",
            "0.1.15",
            "0.1.14",
            "0.1.13",
            "0.1.12",
            "0.1.11",
            "0.1.10",
            "0.1.9",
            "0.1.8",
            "0.1.7",
            "0.1.6",
            "0.1.5",
            "0.1.4",
            "0.1.3",
            "0.1.2",
            "0.1.1",
            "0.1.0",
            "0.0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-13173.json"
          }
        }
      ],
      "modified": "2026-10-20T10:50:42.056614766Z",
      "provider": "osv",
      "references": [
        "https://usn.ubuntu.com/4123-1/",
        "https://github.com/npm/fstream/commit/6a77d2fa6e1462693cf8e46f930da96ec1b0bb22",
        "https://www.npmjs.com/advisories/886"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2019-13173",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 382019,
  "published_at": "2019-07-02T20:15:11.823+00:00"
}