CVE-2026-44705

Name of the Vulnerable Software and Affected Versions tmp (affected versions not specified)

Description The tmp npm package contains a path traversal issue that allows escaping the intended temporary directory when untrusted data is passed into the prefix, postfix, or dir options. By embedding traversal sequences such as ../ or path separators, attackers can cause files to be created at attacker-controlled locations with the privileges of the running process. This occurs because the package directly concatenates user-supplied options into file paths without proper sanitization or validation, relying on path.join() which normalizes traversal sequences. The issue affects the tmp.file(), tmp.dir(), and tmp.tmpName() functions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize the prefix and postfix parameters by removing path separators and traversal sequences, and validate that the dir parameter is not an absolute path and does not escape the base directory. Avoid passing user-controlled data to the tmp.file(), tmp.dir(), and tmp.tmpName() functions.