CVE-2026-49982: CWE-20: Improper Input Validation in raszi node-tmp
A vulnerability in node-tmp version 0.2.6 allows improper input validation leading to directory traversal. The _assertPath guard fails to block non-string inputs that can be coerced into paths escaping the intended temporary directory. This enables attackers to create files or directories at arbitrary locations with the host process's privileges. The issue is fixed in version 0.2.7.
AI Analysis
Technical Summary
The node-tmp package version 0.2.6 contains an improper input validation vulnerability (CWE-20) where the _assertPath guard only rejects string values containing '..' but does not properly handle non-string inputs such as Arrays or Buffers. These inputs bypass the guard because their includes('..') check returns falsy, yet their string coercion results in paths containing '../', allowing directory traversal (CWE-22). This leads to creation of files or directories outside the intended temporary directory with the privileges of the host process. The vulnerability affects functions tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, and tmp.tmpNameSync when untrusted data is passed without explicit type coercion. The vulnerability is fixed in node-tmp version 0.2.7.
Potential Impact
An attacker who can supply untrusted input to the affected node-tmp functions can cause directory traversal, resulting in creation of files or directories at arbitrary locations on the host filesystem. This can lead to privilege escalation or unauthorized file system modifications with the privileges of the host process. The CVSS score is 8.2 (high), indicating a significant risk if exploited.
Mitigation Recommendations
Upgrade node-tmp to version 0.2.7 or later where this vulnerability is fixed. Until upgraded, ensure that all inputs to tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, and tmp.tmpNameSync are explicitly coerced to strings and validated to prevent directory traversal. Patch status is confirmed fixed in 0.2.7.
CVE-2026-49982: CWE-20: Improper Input Validation in raszi node-tmp
Description
A vulnerability in node-tmp version 0.2.6 allows improper input validation leading to directory traversal. The _assertPath guard fails to block non-string inputs that can be coerced into paths escaping the intended temporary directory. This enables attackers to create files or directories at arbitrary locations with the host process's privileges. The issue is fixed in version 0.2.7.
CVSS v3.1
Score 8.2high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The node-tmp package version 0.2.6 contains an improper input validation vulnerability (CWE-20) where the _assertPath guard only rejects string values containing '..' but does not properly handle non-string inputs such as Arrays or Buffers. These inputs bypass the guard because their includes('..') check returns falsy, yet their string coercion results in paths containing '../', allowing directory traversal (CWE-22). This leads to creation of files or directories outside the intended temporary directory with the privileges of the host process. The vulnerability affects functions tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, and tmp.tmpNameSync when untrusted data is passed without explicit type coercion. The vulnerability is fixed in node-tmp version 0.2.7.
Potential Impact
An attacker who can supply untrusted input to the affected node-tmp functions can cause directory traversal, resulting in creation of files or directories at arbitrary locations on the host filesystem. This can lead to privilege escalation or unauthorized file system modifications with the privileges of the host process. The CVSS score is 8.2 (high), indicating a significant risk if exploited.
Mitigation Recommendations
Upgrade node-tmp to version 0.2.7 or later where this vulnerability is fixed. Until upgraded, ensure that all inputs to tmp.file, tmp.fileSync, tmp.dir, tmp.dirSync, tmp.tmpName, and tmp.tmpNameSync are explicitly coerced to strings and validated to prevent directory traversal. Patch status is confirmed fixed in 0.2.7.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-02T18:30:51.282Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a2ae619815e7002b80ac460
Added to database: 06/11/2026, 16:45:13 UTC
Last enriched: 06/18/2026, 18:02:12 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 128
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.