What is GHSA-2vp2-8m5j-4rjx?

GHSA-2vp2-8m5j-4rjx is a security advisory published by GitHub Security Advisories with Medium severity. cnlh nps vulnerable to file overwrite by local user

Which CVE IDs does GHSA-2vp2-8m5j-4rjx cover?

GHSA-2vp2-8m5j-4rjx covers the following CVE IDs: CVE-2019-15119. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2vp2-8m5j-4rjx?

GHSA-2vp2-8m5j-4rjx has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

Which products are affected by GHSA-2vp2-8m5j-4rjx?

GHSA-2vp2-8m5j-4rjx affects 1 product, including: go/ehang.io/nps:\u003c 0.23.2.

GHSA-2vp2-8m5j-4rjxMediumCVSS 5.5

cnlh nps vulnerable to file overwrite by local user

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

April 17, 2025

🔗 CVE IDs covered (1)

CVE-2019-15119 →

📋 Description

lib/install/install.go in cnlh nps prior to 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.

🎯 Affected products1

go/ehang.io/nps:< 0.23.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-15119
https://github.com/cnlh/nps/issues/176
https://github.com/cnlh/nps/commit/7178b3380720e910d283036a8d39879a94105515
https://github.com/advisories/GHSA-2vp2-8m5j-4rjx