CVE-2026-0775 High severity. npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability

[Mauripache]

Just wanted to bring your attention to a new CVE regarding npm cli, it hasn't been reviewed by GitHub yet and you might not be aware yet. It's affecting the latest 11.8.0 npm version
https://nvd.nist.gov/vuln/detail/CVE-2026-0775

[r-lam]

For reference, this has been explained here: https://gist.github.com/alon710/0073bbd91e0da650b24d44b6f6da75db

And yes... it is throwing alarms on all scanners already and breaking builds.

[aaronaleixander]

There seems to be another vulnerability with tar? and npm might need to bump tar version according to aqua scanner in my pipelines:

https://nvd.nist.gov/vuln/detail/CVE-2026-24842

[Eliza-Huang]

Following, seeing this issue too

[Mauripache]

There seems to be another vulnerability with tar? and npm might need to bump tar version according to aqua scanner in my pipelines:

https://nvd.nist.gov/vuln/detail/CVE-2026-24842

This seems to be directly linked to npm according to https://www.zerodayinitiative.com/advisories/ZDI-26-043/ . The tar vulnerability seems to be a different one that should be resolved by tar and then just get the package version updated here as usual

[r-lam]

There seems to be another vulnerability with tar? and npm might need to bump tar version according to aqua scanner in my pipelines:
https://nvd.nist.gov/vuln/detail/CVE-2026-24842

This seems to be directly linked to npm according to https://www.zerodayinitiative.com/advisories/ZDI-26-043/ . The tar vulnerability seems to be a different one that should be resolved by tar and then just get the package version updated here as usual

My bad, I mixed thoughts when reading this while at work!
But yeah, different issue. It is fixed (tar v7.5.7) but not yet released as hotfix by any PR on this repo

[tcmtest]

There seems to be another vulnerability with tar? and npm might need to bump tar version according to aqua scanner in my pipelines:
https://nvd.nist.gov/vuln/detail/CVE-2026-24842

This seems to be directly linked to npm according to https://www.zerodayinitiative.com/advisories/ZDI-26-043/ . The tar vulnerability seems to be a different one that should be resolved by tar and then just get the package version updated here as usual

My bad, I mixed thoughts when reading this while at work! But yeah, different issue. It is fixed (tar v7.5.7) but not yet released as hotfix by any PR on this repo

Any chance of tar 7.5.7 included in npm cli soon? Appreciate any ETA here please.

[lucas-gomes-santana]

Hello guys. I saw this same problem on pnpm repository and I opened a PR that was accepted and merged to solve the issue: pnpm/pnpm#10539

I will fork the repository and research about it.

[Mauripache]

Hello guys. I saw this same problem on pnpm repository and I opened a PR that was accepted and merged to solve the issue: pnpm/pnpm#10539

I will fork the repository and research about it.

There seems to be another vulnerability with tar? and npm might need to bump tar version according to aqua scanner in my pipelines:
https://nvd.nist.gov/vuln/detail/CVE-2026-24842

This seems to be directly linked to npm according to https://www.zerodayinitiative.com/advisories/ZDI-26-043/ . The tar vulnerability seems to be a different one that should be resolved by tar and then just get the package version updated here as usual

My bad, I mixed thoughts when reading this while at work! But yeah, different issue. It is fixed (tar v7.5.7) but not yet released as hotfix by any PR on this repo

Any chance of tar 7.5.7 included in npm cli soon? Appreciate any ETA here please.

It seems the PR to bump tar from 7.5.4 to 7.5.7 is already merged in #8951 for next release 11.9.0. I don't know about the problem with npm itself though

[lucas-gomes-santana]

Hello guys. I saw this same problem on pnpm repository and I opened a PR that was accepted and merged to solve the issue: pnpm/pnpm#10539
I will fork the repository and research about it.

There seems to be another vulnerability with tar? and npm might need to bump tar version according to aqua scanner in my pipelines:
https://nvd.nist.gov/vuln/detail/CVE-2026-24842

This seems to be directly linked to npm according to https://www.zerodayinitiative.com/advisories/ZDI-26-043/ . The tar vulnerability seems to be a different one that should be resolved by tar and then just get the package version updated here as usual

My bad, I mixed thoughts when reading this while at work! But yeah, different issue. It is fixed (tar v7.5.7) but not yet released as hotfix by any PR on this repo

Any chance of tar 7.5.7 included in npm cli soon? Appreciate any ETA here please.

It seems the PR to bump tar from 7.5.4 to 7.5.7 is already merged in #8951 for next release 11.9.0. I don't know about the problem with npm itself though

Yeah, I saw #8951 now, I think the npm itself doesn't have any problem.

[Mauripache]

Hello guys. I saw this same problem on pnpm repository and I opened a PR that was accepted and merged to solve the issue: pnpm/pnpm#10539
I will fork the repository and research about it.

There seems to be another vulnerability with tar? and npm might need to bump tar version according to aqua scanner in my pipelines:
https://nvd.nist.gov/vuln/detail/CVE-2026-24842

This seems to be directly linked to npm according to https://www.zerodayinitiative.com/advisories/ZDI-26-043/ . The tar vulnerability seems to be a different one that should be resolved by tar and then just get the package version updated here as usual

My bad, I mixed thoughts when reading this while at work! But yeah, different issue. It is fixed (tar v7.5.7) but not yet released as hotfix by any PR on this repo

Any chance of tar 7.5.7 included in npm cli soon? Appreciate any ETA here please.

It seems the PR to bump tar from 7.5.4 to 7.5.7 is already merged in #8951 for next release 11.9.0. I don't know about the problem with npm itself though

Yeah, I saw #8951 now, I think the npm itself doesn't have any problem.

It does, CVE-2026-0775 affects npm cli directly https://nvd.nist.gov/vuln/detail/CVE-2026-0775

[samueloph]

I've emailed zdi@trendmicro.com asking for more details about CVE-2026-0775.

I suggest people don't use this issue to talk about the tar CVE as it will lead to confusion.

It would be helpful if the npm devs could reply here with details as well, I assume ZDI contacted them at some point, even if they consider this by-design, the fact that ZDI went ahead and created a CVE forces a lot of people to take action, and even though the action will likely end up be stating that the CVE won't be fixed, more details are needed.

[MikeMcC399]

https://www.zerodayinitiative.com/advisories/ZDI-26-043/ says:

It sounds like there is a fundamental disagreement here (perhaps about the applicable threat model) and probably a statement from npm would be helpful.

Clearly npm allows a wide range of sources for dependencies, by design.

pnpm has implemented a whole set of configuration options to control which dependencies can execute code through hooks, for example https://pnpm.io/cli/add#--allow-build , however it's not clear from the description in the zero day initiative whether this is what they are looking for.

[MikeMcC399]

Could a maintainer perhaps hide the off-topic posts relating to CVE-2026-24842 since this issue is supposed to be about CVE-2026-0775? It's very confusing to have the off-topic discussion mixed in here!

[Mauripache]

Npm 11.9.0 has been released, this issue has not been addressed yet, just FYI