Versions of bower prior to 1.8.8 are affected by an arbitrary file write vulnerability. The vulnerability occurs because bower does not verify that extracted symbolic links do not resolve to targets outside of the extraction root directory.
// recommendation
Update to version 1.8.8 or later
// cvss v3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Checked 2026-11-06 at 21:31 UTC. The most recent advisory here was published 2019-09-17. Updated continuously from NVD, GHSA, OSV and CNA feeds.