CVE-2026-44705: Path Traversal in raszi tmp npm Package (v<0.2.6)

Technical summary

CVE-2026-44705 is a path traversal vulnerability (CWE-22) in the raszi tmp npm package prior to version 0.2.6. The vulnerability exists in the file and directory creation functions when they process the prefix, postfix, or dir parameters. If these parameters contain untrusted data with embedded path traversal sequences (../) or absolute path separators, the package fails to sanitize them before constructing the final file path. This allows an attacker to escape the configured temporary directory base and create files at arbitrary locations with the privileges of the Node.js process. The CVSS 3.1 score is 8.2 (HIGH), reflecting network accessibility, low attack complexity, high integrity impact, and some availability impact.

Business impact

Applications using vulnerable versions of tmp are at risk if they incorporate user-supplied input into temporary file creation workflows. This could enable attackers to overwrite sensitive application files, inject malicious code into executable locations, corrupt data directories, or cause application failures. In CI/CD pipelines or backend services processing untrusted uploads or API requests, this becomes particularly dangerous. The impact depends on the application's privilege level and what sensitive paths exist on the system, but the potential for lateral privilege escalation or supply chain compromise via file injection makes this a material risk for any production Node.js environment handling user input.

Affected systems

The raszi tmp npm package versions prior to 0.2.6 are affected. Any Node.js application that depends on tmp and passes unsanitized user-controlled data to the prefix, postfix, or dir parameters is vulnerable. This includes web applications, API servers, file processing services, and CI/CD tooling that use tmp without input validation on these parameters. The vulnerability requires that the application actually invokes tmp's file/directory creation functions with attacker-controlled input, so not all users of the package are necessarily exposed—only those with such a code path.

Exploitability

The vulnerability is exploitable over the network (CVSS vector shows AV:N) with no authentication required and no user interaction. An attacker needs only to supply crafted input to an endpoint or function that eventually passes it to tmp's prefix, postfix, or dir options. The attack is straightforward—injecting '../' or absolute paths requires no special tools or race conditions. However, exploitation requires that the application actually flows user input into one of these parameters without sanitization, so the real-world impact depends on application design. Applications that properly validate or reject traversal sequences in user input are protected.

Remediation

Upgrade the raszi tmp package to version 0.2.6 or later. This should be treated as a priority update for any application handling user input. Beyond patching, teams should audit their codebase to identify all points where tmp's functions receive user-supplied data. Implement input validation at the application layer: reject or sanitize any prefix, postfix, or dir values that contain path separators or traversal sequences. In defense-in-depth terms, also consider running Node.js processes with minimal filesystem permissions and using containerization or chroot to limit the scope of potential file write operations.

Patch guidance

Update the tmp package to version 0.2.6 or newer by running 'npm update tmp' or editing package.json to specify '^0.2.6' (or later) and reinstalling. Verify the update by checking 'npm list tmp' to confirm the installed version. If your project uses a lock file (package-lock.json or yarn.lock), ensure it is regenerated and committed. Test your application thoroughly after the update to ensure no regressions in temporary file handling. For pinned or legacy projects, confirm compatibility with version 0.2.6 before deploying to production.

Detection guidance

Monitor npm audit output and your software composition analysis (SCA) tools for CVE-2026-44705 flagged against tmp versions <0.2.6. In runtime detection, log all invocations to tmp's file creation functions and inspect the prefix, postfix, and dir parameters for suspicious patterns like '../', '..\', or absolute paths. Correlate with user input sources to identify where unsanitized data might flow. Network-based detection is difficult since this is a logic flaw; focus on static analysis (SAST) scanning for tmp usage patterns where user input is passed without validation, and dynamic testing of user-input workflows.

Why prioritize this

This vulnerability merits immediate attention: it has a HIGH CVSS score (8.2), is network-accessible with no authentication barrier, and can result in arbitrary file write as the running process user. While it requires vulnerable application code patterns (passing user input to tmp without sanitization), such patterns are plausible in real applications, especially those processing uploads or external API data. The fact that it's not yet in the KEV catalog suggests active but not yet widespread exploitation, making this a window for proactive patching. Any organization with Node.js backend services or tooling should prioritize an inventory and upgrade of tmp immediately.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) reflects: (1) network attack vector—exploitable remotely with no special access; (2) low complexity—no special conditions or race conditions required; (3) no privileges or user interaction needed; (4) high integrity impact—attackers can create or overwrite files; (5) low availability impact—may corrupt or delete files. The score appropriately captures the danger of arbitrary file write, though real-world severity also depends on what files can be reached and what the application does with them.

Frequently asked questions