This vulnerability (CVE-2026-0775) in npm CLI version 10.9.0 involves incorrect permission assignment (CWE-732) for critical resources during module loading. The application loads modules from an unsecured location, allowing a local attacker who already has limited code execution capabilities to escalate privileges by executing arbitrary code in the context of a higher-privileged user. The CVSS v3.0 score is 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability was tracked as ZDI-CAN-25430 and is documented in a Red Hat advisory.

Successful exploitation allows a local attacker with low privileges to escalate their privileges on the affected system, potentially leading to full control over the npm CLI environment and execution of arbitrary code with elevated rights. This compromises confidentiality, integrity, and availability of the system where npm CLI is installed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory linked does not explicitly state a patch or workaround. Until an official fix is released, restrict local code execution permissions to trusted users only to reduce risk.