CVE-2026-0775 — npm CLI Local Privilege Escalation
CVE ID: CVE-2026-0775
Affected component: npm CLI
Vulnerability class: Local Privilege Escalation (Incorrect permission handling)
CVSS v3.x score: 7.0
Severity: High
Attack vector: Local
User interaction: Not required once local code execution exists
Exploit maturity: No widely published weaponized exploit; exploitation techniques are possible and practical in real environments
Exploit availability: Educational / proof-of-concept–level techniques possible
Impact: Developer workstation takeover, CI runner compromise, privilege escalation to administrative or root level
Official patch / upgrade link: https://github.com/npm/cli/releases
Executive summary
A flaw in the npm command-line interface allows locally running code to gain higher privileges than intended. Due to unsafe permission handling and trust of module execution paths, npm can be tricked into executing attacker-controlled code with elevated rights. On developer machines or CI systems, this can result in full system compromise, persistence, and credential theft.
What is happening
The npm CLI performs module loading and execution during common operations such as installs, builds, and script execution. In vulnerable versions, insufficient validation of file ownership and permissions is performed before executing certain modules or scripts. As a result, npm may load code from directories that are writable by non-privileged users or inherit elevated permissions during execution.
Because npm is frequently used in environments with broader filesystem access (global installs, shared directories, CI runners), attacker-controlled files can be executed in a higher-trust context than intended. This represents an incorrect permission assignment for a security-critical resource.
Why this is dangerous
When npm is invoked by a privileged user, build service, or automation tool:
- Arbitrary commands may be executed under elevated privileges
- System binaries or scripts may be overwritten
- Startup services or scheduled tasks may be planted
- Developer credentials, SSH keys, API tokens, and signing keys may be stolen
In practice, this means a single compromised developer account or malicious package can lead to full workstation or pipeline takeover.
Attack prerequisites
This vulnerability does not provide initial access. The following condition must already exist:
- Ability to execute code as a local, low-privileged user
- malicious dependency
- compromised developer account
- untrusted script execution
- poisoned CI job or build step
Once that condition is met, privilege escalation becomes feasible.
How exploitation would occur
The following is a conceptual explanation intended for defensive understanding.
- A malicious module or script is placed in a directory that npm may load from or execute.
- The directory is writable by the attacker but trusted by npm during execution.
- npm is triggered via a standard command (
install,run,exec, etc.). - The malicious code executes in npm’s context.
- Privileged filesystem access or system commands are performed.
- Persistence mechanisms or privilege escalation techniques are applied.
This chain allows escalation from a normal user to administrator or root depending on how npm is invoked.
Proof-of-concept status
- No fully weaponized public exploit has been broadly released.
- Exploitation techniques are feasible and reproducible in controlled environments.
- Attack patterns rely on abuse of npm lifecycle scripts, binary resolution, or trusted path execution.
- All known demonstrations are suitable only for educational or defensive research purposes.
MITRE mapping
- CWE: Incorrect Permission Assignment for Critical Resource
- ATT&CK tactic: Privilege Escalation
- ATT&CK technique: Exploitation for Privilege Escalation (T1068)
Indicators of exploitation
The following behaviors should be considered suspicious when observed around npm activity:
- npm or node spawning shell interpreters (
cmd.exe,powershell.exe,bash,sh) - npm writing files into system or application directories
- npm execution followed by privilege changes or new services
- Unexpected outbound network connections initiated by npm
- Modification of startup scripts, cron jobs, or scheduled tasks
- npm activity outside expected development or build windows
Log sources to monitor
- Endpoint process creation logs
- File integrity monitoring on system directories
- npm execution logs and debug logs
- CI/CD pipeline execution logs
- EDR telemetry (parent–child process relationships)
Sysmon detection rules
Rule 1 — npm spawning a shell
<Sysmon schemaversion="4.90">
<EventFiltering>
<ProcessCreate onmatch="include">
<ParentImage condition="contains">npm</ParentImage>
<Image condition="contains">cmd.exe</Image>
</ProcessCreate>
<ProcessCreate onmatch="include">
<ParentImage condition="contains">npm</ParentImage>
<Image condition="contains">powershell.exe</Image>
</ProcessCreate>
</EventFiltering>
</Sysmon>
Rule 2 — npm or node writing to privileged directories
<Sysmon schemaversion="4.90">
<EventFiltering>
<FileCreate onmatch="include">
<Image condition="contains">npm</Image>
<TargetFilename condition="contains">\Program Files\</TargetFilename>
</FileCreate>
<FileCreate onmatch="include">
<Image condition="contains">node</Image>
<TargetFilename condition="contains">\Windows\System32\</TargetFilename>
</FileCreate>
</EventFiltering>
</Sysmon>
Rule 3 — npm spawning service or task creation tools
<Sysmon schemaversion="4.90">
<EventFiltering>
<ProcessCreate onmatch="include">
<ParentImage condition="contains">npm</ParentImage>
<Image condition="contains">sc.exe</Image>
</ProcessCreate>
<ProcessCreate onmatch="include">
<ParentImage condition="contains">npm</ParentImage>
<Image condition="contains">schtasks.exe</Image>
</ProcessCreate>
</EventFiltering>
</Sysmon>
Detection strategy
- Alerts should be raised when npm spawns interpreters or system tools.
- npm execution should be correlated with privileged filesystem writes.
- npm usage outside developer or CI contexts should be investigated.
- Any npm process initiating network connections should be reviewed.
Mitigation and remediation
- npm CLI should be upgraded immediately once a fixed release is available.
- npm should never be run with administrative or root privileges unless strictly required.
- Global npm directories should not be writable by non-administrative users.
- CI runners should be isolated, ephemeral, and non-persistent.
- Lifecycle scripts should be restricted or disabled in sensitive environments.
- Endpoint monitoring rules should be deployed before exploitation becomes public.
Final takeaway
CVE-2026-0775 highlights how trusted developer tooling can become a powerful attack vector. While exploitation requires local access, modern development environments make such access common. Once abused, the impact is severe and often silent. Early detection and strict execution controls around npm are critical to preventing workstation and pipeline compromise.
