A flaw in npm CLI arises when the package manager loads modules from an unsecured location and applies incorrect permission assignments. This permits a local adversary who already has the ability to run low‑privileged code on the system to elevate privileges and execute arbitrary code with the effective rights of the target user. The vulnerability could compromise confidentiality, integrity, and availability of user data and system resources.

The issue affects installations of the npm command‑line interface. No specific version ranges were supplied, so all current npm CLI deployments are potentially vulnerable until a fix is applied.

The Common Vulnerability Scoring System rates the defect at 7.0, labeling it as a moderate severity flaw. Exploit probability, per the Exploit Prediction Scoring System, is below 1%, indicating that attacks are considered unlikely at present. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, further limiting the likelihood of widespread exploitation. The threat surface is local; an attacker requires prior ability to execute code at low privilege to launch an escalation attempt. The combination of moderate CVSS, low EPSS, and lack of active exploitation suggests a measured but non‑negligible risk for environments without immediate mitigation.