CVE catalog

CVE-2020-15095

npm: CVE-2020-15095

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.40% · Oct 25, 2026

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannpmsid12.2.0+ds1-1fixed
Debiannpmforky12.2.0+ds1-1fixed
Debiannpmtrixie9.2.0~ds1-3fixed
Debiannpmbookworm9.2.0~ds1-1fixed
Opensusenodejs10leap 15.210.22.1-lp152.2.6.1fixed
Opensusenodejs8leap 15.18.17.0-lp151.2.21.1fixed
Susenodejs12linux enterprise module for web and scripting 1212.18.4-1.20.1fixed
Susenodejs8linux enterprise module for web and scripting 15 sp18.17.0-3.38.1fixed
Susenodejs10linux enterprise module for web and scripting 1210.22.1-1.30.1fixed
Susenodejs12linux enterprise module for web and scripting 15 sp212.18.4-4.6.1fixed
Opensusenodejs12leap 15.212.18.4-lp152.3.6.1fixed
Ubuntunpm14.041.2.18~dfsg-3vulnerable
Ubuntunpm14.041.3.10~dfsg-1vulnerable
Ubuntunpmpro3.5.2-0ubuntu4vulnerable
Ubuntunpmpro3.5.2-0ubuntu4.1.18.04.1~esm1vulnerable
Ubuntunpm20.045.8.0+ds6-4vulnerable
Ubuntunpm20.046.14.4+ds-1ubuntu2vulnerable
Susenodejs10linux enterprise module for web and scripting 15 sp110.22.1-1.27.1fixed
Susenodejs10linux enterprise module for web and scripting 15 sp210.22.1-1.27.1fixed
Susenodejs10linux enterprise high performance computing 15-espos10.22.1-1.27.1fixed
Susenodejs10linux enterprise high performance computing 15-ltss10.22.1-1.27.1fixed
Susenodejs10linux enterprise server 15-ltss10.22.1-1.27.1fixed
Susenodejs10linux enterprise server for sap applications 1510.22.1-1.27.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannpmsourcesid6.14.6+ds-1lowNot reported[964746]
Debiannpmsourceforky6.14.6+ds-1lowNot reported[964746]
Debiannpmsourcetrixie6.14.6+ds-1lowNot reported[964746]
Debiannpmsourcebookworm6.14.6+ds-1lowNot reported[964746]
Opensusenodejs10rpmleap 15.210.22.1-lp152.2.6.1Not reportedOPENSUSE-SU-2020:1660-1Not reported
Opensusenodejs8rpmleap 15.18.17.0-lp151.2.21.1Not reportedOPENSUSE-SU-2020:1644-1Not reported
Susenodejs12rpmlinux enterprise module for web and scripting 1212.18.4-1.20.1Not reportedSUSE-SU-2020:2812-1Not reported
Susenodejs8rpmlinux enterprise module for web and scripting 15 sp18.17.0-3.38.1Not reportedSUSE-SU-2020:2870-1Not reported
Susenodejs10rpmlinux enterprise module for web and scripting 1210.22.1-1.30.1Not reportedSUSE-SU-2020:2823-1Not reported
Susenodejs12rpmlinux enterprise module for web and scripting 15 sp212.18.4-4.6.1Not reportedSUSE-SU-2020:2813-1Not reported
Opensusenodejs12rpmleap 15.212.18.4-lp152.3.6.1Not reportedOPENSUSE-SU-2020:1616-1Not reported
Susenodejs10rpmlinux enterprise module for web and scripting 15 sp110.22.1-1.27.1Not reportedSUSE-SU-2020:2829-1Not reported
Susenodejs10rpmlinux enterprise module for web and scripting 15 sp210.22.1-1.27.1Not reportedSUSE-SU-2020:2829-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15-espos10.22.1-1.27.1Not reportedSUSE-SU-2020:2829-1Not reported
Susenodejs10rpmlinux enterprise high performance computing 15-ltss10.22.1-1.27.1Not reportedSUSE-SU-2020:2829-1Not reported
Susenodejs10rpmlinux enterprise server 15-ltss10.22.1-1.27.1Not reportedSUSE-SU-2020:2829-1Not reported
Susenodejs10rpmlinux enterprise server for sap applications 1510.22.1-1.27.1Not reportedSUSE-SU-2020:2829-1Not reported

[Debian bug #964746]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [npm]Fixed
    Details (2)

    • 9.2.0~ds1-1 · all · bookworm

      Fixed · Fixed: 6.14.6+ds-1

      dsa · npm · debian · bookworm; dsa · npm · debian · 12

    • 9.2.0~ds1-1 · all · bookworm

      Fixed · Fixed: 6.14.6+ds-1

      dsa · npm · debian · bookworm; dsa · npm · debian · 12

[Debian 13 (Trixie)]

  • [npm]Fixed
    Details (2)

    • 9.2.0~ds1-3 · all · trixie

      Fixed · Fixed: 6.14.6+ds-1

      dsa · npm · debian · 13

    • 9.2.0~ds1-3 · all · trixie

      Fixed · Fixed: 6.14.6+ds-1

      dsa · npm · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]