tmp, a temporary file and directory generator for node.js, uses a guard called _assertPath to reject unsafe names. In version 0.2.6 the guard only checks for the substring ".." in string values. The check can be bypassed when the prefix, postfix or template options are supplied as non-string objects such as arrays, buffers or custom objects whose includes('..') method returns falsy but whose stringification still contains "../". The resulting path is assembled via path.join and can escape the intended temporary directory, allowing an attacker to create or overwrite files or directories at arbitrary locations with the host process's privileges. This elevates to arbitrary file creation or modification and therefore potential remote code execution if the created file is later executable or includes attacker-controlled logic. The weakness is a classic type confusion (CWE-20) combined with improper path traversal validation (CWE-22).

The vulnerability is present in the node-tmp package from the raszi vendor. Any installation of version 0.2.6 that relies on the API functions tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, or tmp.tmpNameSync and accepts untrusted input for the options prefix, postfix or template is impacted. The fix is available in version 0.2.7.

The CVSS score is 8.2, indicating high severity. No EPSS data is available, suggesting that exploitation likelihood has not been quantified but the lack of public reports means the threat is not yet proven. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending crafted payloads through HTTP request bodies or query strings that provide non-string values for the prefix, postfix or template fields; these values bypass the guard and allow path traversal. With the host process running under elevated privileges, an attacker could place malicious files in protected directories, leading to code execution or privilege escalation.