Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-fucn-8p7k-6qe8

Summary

Predictable temp filenames allow overwrite of arbitrary files
npm allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

Aliases

alias	CVE-2013-4116

alias	GHSA-v3jv-wrf4-5845

Fixed_packages

url	pkg:deb/debian/npm@1.3.10~dfsg-1?distro=trixie
purl	pkg:deb/debian/npm@1.3.10~dfsg-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/npm@1.3.10~dfsg-1%3Fdistro=trixie

url pkg:deb/debian/npm@7.5.2%2Bds-2?distro=trixie

purl pkg:deb/debian/npm@7.5.2%2Bds-2?distro=trixie

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-368z-yjtu-m3hc

vulnerability	VCID-9vk1-2ysq-3ygd

vulnerability	VCID-myru-vzn7-u7cf

resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/npm@7.5.2%252Bds-2%3Fdistro=trixie

url	pkg:deb/debian/npm@9.2.0~ds1-1?distro=trixie
purl	pkg:deb/debian/npm@9.2.0~ds1-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/npm@9.2.0~ds1-1%3Fdistro=trixie

url	pkg:deb/debian/npm@9.2.0~ds1-3?distro=trixie
purl	pkg:deb/debian/npm@9.2.0~ds1-3?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/npm@9.2.0~ds1-3%3Fdistro=trixie

url	pkg:deb/debian/npm@9.2.0~ds3-1?distro=trixie
purl	pkg:deb/debian/npm@9.2.0~ds3-1?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/npm@9.2.0~ds3-1%3Fdistro=trixie

url	pkg:deb/debian/npm@11.12.1~ds1-2?distro=trixie
purl	pkg:deb/debian/npm@11.12.1~ds1-2?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/npm@11.12.1~ds1-2%3Fdistro=trixie

url	pkg:deb/debian/npm@11.12.1~ds1-3?distro=trixie
purl	pkg:deb/debian/npm@11.12.1~ds1-3?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/npm@11.12.1~ds1-3%3Fdistro=trixie

url	pkg:deb/debian/npm@11.12.1~ds1-4?distro=trixie
purl	pkg:deb/debian/npm@11.12.1~ds1-4?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/npm@11.12.1~ds1-4%3Fdistro=trixie

url pkg:npm/npm@1.2.8000

purl pkg:npm/npm@1.2.8000

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.2.8000

url pkg:npm/npm@1.3.0

purl pkg:npm/npm@1.3.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.3.0

Affected_packages

url pkg:npm/npm@1.1.25

purl pkg:npm/npm@1.1.25

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.1.25

url pkg:npm/npm@1.1.70

purl pkg:npm/npm@1.1.70

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.1.70

url pkg:npm/npm@1.1.71

purl pkg:npm/npm@1.1.71

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.1.71

url pkg:npm/npm@1.2.19

purl pkg:npm/npm@1.2.19

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.2.19

url pkg:npm/npm@1.2.20

purl pkg:npm/npm@1.2.20

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.2.20

url pkg:npm/npm@1.2.21

purl pkg:npm/npm@1.2.21

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.2.21

url pkg:npm/npm@1.2.22

purl pkg:npm/npm@1.2.22

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.2.22

url pkg:npm/npm@1.2.23

purl pkg:npm/npm@1.2.23

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.2.23

url pkg:npm/npm@1.2.24

purl pkg:npm/npm@1.2.24

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.2.24

url pkg:npm/npm@1.2.25

purl pkg:npm/npm@1.2.25

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.2.25

url pkg:npm/npm@1.2.27

purl pkg:npm/npm@1.2.27

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.2.27

url pkg:npm/npm@1.2.28

purl pkg:npm/npm@1.2.28

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.2.28

url pkg:npm/npm@1.2.30

purl pkg:npm/npm@1.2.30

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.2.30

url pkg:npm/npm@1.2.31

purl pkg:npm/npm@1.2.31

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.2.31

url pkg:npm/npm@1.2.32

purl pkg:npm/npm@1.2.32

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-e2wc-na6c-c3cr

vulnerability	VCID-fucn-8p7k-6qe8

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-qyqn-hwvx-k7gs

vulnerability	VCID-sz3c-y3nq-1qdc

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/npm@1.2.32

References

reference_url	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4116.json
reference_id
reference_type
scores
url	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-4116.json

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2013-4116

reference_id

reference_type

scores

value	0.00104
scoring_system	epss
scoring_elements	0.28362
published_at	2026-04-08T12:55:00Z

value	0.00104
scoring_system	epss
scoring_elements	0.2832
published_at	2026-04-16T12:55:00Z

value	0.00104
scoring_system	epss
scoring_elements	0.28308
published_at	2026-04-13T12:55:00Z

value	0.00104
scoring_system	epss
scoring_elements	0.28367
published_at	2026-04-12T12:55:00Z

value	0.00104
scoring_system	epss
scoring_elements	0.28409
published_at	2026-04-11T12:55:00Z

value	0.00104
scoring_system	epss
scoring_elements	0.2839
published_at	2026-04-01T12:55:00Z

value	0.00104
scoring_system	epss
scoring_elements	0.28465
published_at	2026-04-02T12:55:00Z

value	0.00104
scoring_system	epss
scoring_elements	0.28507
published_at	2026-04-04T12:55:00Z

value	0.00104
scoring_system	epss
scoring_elements	0.28298
published_at	2026-04-07T12:55:00Z

value	0.00104
scoring_system	epss
scoring_elements	0.28406
published_at	2026-04-09T12:55:00Z

value	0.00104
scoring_system	epss
scoring_elements	0.28299
published_at	2026-04-18T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2013-4116

reference_url

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=715325

reference_id

reference_type

scores

value	LOW
scoring_system	generic_textual
scoring_elements

url

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=715325

reference_url

https://bugzilla.redhat.com/show_bug.cgi?id=983917

reference_id

reference_type

scores

value	LOW
scoring_system	generic_textual
scoring_elements

url

https://bugzilla.redhat.com/show_bug.cgi?id=983917

reference_url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4116
reference_id
reference_type
scores
url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4116

reference_url

https://exchange.xforce.ibmcloud.com/vulnerabilities/87141

reference_id

reference_type

scores

value	LOW
scoring_system	generic_textual
scoring_elements

url

https://exchange.xforce.ibmcloud.com/vulnerabilities/87141

reference_url

https://github.com/npm/npm

reference_id

reference_type

scores

value	LOW
scoring_system	generic_textual
scoring_elements

url

https://github.com/npm/npm

reference_url

https://github.com/npm/npm/commit/f4d31693

reference_id

reference_type

scores

value	LOW
scoring_system	generic_textual
scoring_elements

url

https://github.com/npm/npm/commit/f4d31693

reference_url

https://github.com/npm/npm/issues/3635

reference_id

reference_type

scores

value	3.2
scoring_system	cvssv3
scoring_elements

value	LOW
scoring_system	generic_textual
scoring_elements

url

https://github.com/npm/npm/issues/3635

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2013-4116

reference_id

reference_type

scores

value	LOW
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2013-4116

reference_url

https://www.npmjs.com/advisories/152

reference_id

reference_type

scores

value	LOW
scoring_system	generic_textual
scoring_elements

url

https://www.npmjs.com/advisories/152

reference_url

http://www.openwall.com/lists/oss-security/2013/07/10/17

reference_id

reference_type

scores

value	3.2
scoring_system	cvssv3
scoring_elements

value	LOW
scoring_system	generic_textual
scoring_elements

url

http://www.openwall.com/lists/oss-security/2013/07/10/17

reference_url

http://www.openwall.com/lists/oss-security/2013/07/11/9

reference_id

reference_type

scores

value	LOW
scoring_system	generic_textual
scoring_elements

url

http://www.openwall.com/lists/oss-security/2013/07/11/9

reference_url

http://www.securityfocus.com/bid/61083

reference_id

reference_type

scores

value	LOW
scoring_system	generic_textual
scoring_elements

url

http://www.securityfocus.com/bid/61083

reference_url

https://github.com/nodejs/security-wg/blob/main/vuln/npm/152.json

reference_id

152

reference_type

scores

value	3.2
scoring_system	cvssv3
scoring_elements

url

https://github.com/nodejs/security-wg/blob/main/vuln/npm/152.json

reference_url

https://github.com/advisories/GHSA-v3jv-wrf4-5845

reference_id

GHSA-v3jv-wrf4-5845

reference_type

scores

value	LOW
scoring_system	cvssv3.1_qr
scoring_elements

url

https://github.com/advisories/GHSA-v3jv-wrf4-5845

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	59
name	Improper Link Resolution Before File Access ('Link Following')
description	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score 0.1 - 3.2

Exploitability 0.5

Weighted_severity 2.9

Risk_score 1.4

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-fucn-8p7k-6qe8

Vulnerability Instance