npm package report

Is fstream safe?

1 known vulnerability, worst severity HIGH.

// reach

0 direct dependencies

none carry a known advisory

    15 packages depend on it

    an advisory here reaches each of them

    • bower
    • esm
    Create a free accountfor every dependency path, dependent and what to upgrade
    // ai model usage

    Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

    cvss
    7.5
    high

    CVSS v3.0 base score out of 10

    epss
    2.4%
    medium

    chance of exploitation in 30 days, 84th percentile of all CVEs

    xyz score
    4.4
    medium

    CyberXYZ composite out of 10

    fig. 01 — GHSA-xf7w-r453-m56c, the advisory selected below

    // 1 advisories

    GHSA-xf7w-r453-m56c

    HIGHGitHub ratingCVE-2019-13173

    Versions of fstream prior to 1.0.12 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.

    // recommendation

    Upgrade to version 1.0.12 or later.

    // cvss v3.0 vector

    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

    Attack vector
    Network
    Attack complexity
    Low
    Privileges required
    None
    User interaction
    None
    Scope
    Unchanged
    Confidentiality
    None
    Integrity
    High
    Availability
    None

    Checked 2026-11-06 at 21:15 UTC. The most recent advisory here was published 2019-05-30. Updated continuously from NVD, GHSA, OSV and CNA feeds.

    Think a verdict here is wrong? Tell us — we respond within 2 business days.