CVE-2017-18869 — nodejs-chownr: TOCTOU vulnerability in `chownr` function in chownr.js

Back Back to CVE browser

LOW

nodejs-chownr: TOCTOU vulnerability in `chownr` function in chownr.js

Published Jun 15, 2020

2.5

LOW

CVSS 3.1

EPSS 0.34%

Description

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Affected products

Red Hat Software Collections for Red Hat Enterprise Linux 7

rh-nodejs8-nodejs-0:8.17.0-2.el7

Fixed · RHSA-2020:2625
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

rh-nodejs8-nodejs-0:8.17.0-2.el7

Fixed · RHSA-2020:2625
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

rh-nodejs8-nodejs-0:8.17.0-2.el7

Fixed · RHSA-2020:2625
Red Hat Mobile Application Platform 4

nodejs-chownr

Will not fix
Red Hat Software Collections

rh-nodejs6-nodejs-chownr

Will not fix

Product	Package	State	Advisory
Red Hat Software Collections for Red Hat Enterprise Linux 7	rh-nodejs8-nodejs-0:8.17.0-2.el7	Fixed	RHSA-2020:2625
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	rh-nodejs8-nodejs-0:8.17.0-2.el7	Fixed	RHSA-2020:2625
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	rh-nodejs8-nodejs-0:8.17.0-2.el7	Fixed	RHSA-2020:2625
Red Hat Mobile Application Platform 4	nodejs-chownr	Will not fix	n/a
Red Hat Software Collections	rh-nodejs6-nodejs-chownr	Will not fix	n/a

Ecosystem	Package	Introduced	Fixed
npm	chownr	0	1.1.0

Remediation

No remediation recorded yet.

Metrics

0.34% 0.00336

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00336

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (8 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.34% (0.00336)	24.65th	v5 (v2026.06.15)
Sep 20, 2026	0.34% (0.00336)	27.13th	v5 (v2026.06.15)
Jul 20, 2024	0.04% (0.00042)	5.06th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00042)	5.63th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00950)	32.28th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00950)	13.46th	v2 (v2022.01.01)
Feb 3, 2022	0.56% (0.00555)	12.81th	v5 (v2026.06.15)
Apr 14, 2021	0.56% (0.00555)	0.00th	v1

Weaknesses (1)

CWE-367

References (11)

https://access.redhat.com/security/cve/CVE-2017-18869
Vendor Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863985
x_refsource_MISCThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1611613
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1611614
x_refsource_MISCPermissions Required
https://github.com/advisories/GHSA-c6rq-rjc2-86v2
Advisory
https://github.com/isaacs/chownr/commit/36a93e3f0a220062c47b237cf6ab6d5f55cd79c9
https://github.com/isaacs/chownr/commit/a631d841022880e5c8d694408a7e96d6d576d0ce
https://github.com/isaacs/chownr/issues/14
x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-18869
https://snyk.io/vuln/npm:chownr:20180731
x_refsource_MISCExploitThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2017-18869

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2017-18869		Vendor Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863985		x_refsource_MISCThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1611613		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1611614		x_refsource_MISCPermissions Required
https://github.com/advisories/GHSA-c6rq-rjc2-86v2		Advisory
https://github.com/isaacs/chownr/commit/36a93e3f0a220062c47b237cf6ab6d5f55cd79c9
https://github.com/isaacs/chownr/commit/a631d841022880e5c8d694408a7e96d6d576d0ce
https://github.com/isaacs/chownr/issues/14		x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-18869
https://snyk.io/vuln/npm:chownr:20180731		x_refsource_MISCExploitThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2017-18869