CVE-2026-0775High· 7.0▾ Abyssal0daynpm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 38.5 · likelihood 0.1 · exploitation 25
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.3%
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109243Medium· 4.4FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by crypto_write_pem without owner-only permissions
CVE-2026-116124High· 7.8libgsf: libgsf: Arbitrary code execution via heap-based buffer overflow in OLE2 parser (CVE-2026-116124)
CVE-2026-116137Low· 3.7adm-zip: adm-zip: File integrity check bypass via duplicate archive entries (CVE-2026-116137)
CVE-2026-116141Medium· 5.3ImageMagick: ImageMagick: Denial of Service via policy bypass in UHDR decoder (CVE-2026-116141)
CVE-2026-116140Low· 3.3ImageMagick: ImageMagick: Security policy bypass via flawed delegate invocation parsing (CVE-2026-116140)
CVE-2026-116149High· 7.8ImageMagick: ImageMagick: Memory corruption via crafted bzip2 compressed images (CVE-2026-116149)