CVE-2026-0775: (0Day) npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0775?
CVE-2026-0775 is classified as a high severity local privilege escalation vulnerability.
How do I fix CVE-2026-0775?
To fix CVE-2026-0775, ensure you update to the patched version of the npm cli as provided by the vendor.
Who is affected by CVE-2026-0775?
CVE-2026-0775 affects installations of npm cli that have improper permission assignments.
What kind of attacks can be performed exploiting CVE-2026-0775?
Exploiting CVE-2026-0775 allows local attackers to escalate their privileges on the affected npm cli installations.
Is my system at risk if I use npm cli and how can I check?
If you are using npm cli without the latest patches, your system could be at risk from CVE-2026-0775 and you should check for available updates.