cnlh nps vulnerable to file overwrite by local user

MEDIO 5.5CVE-2019-15119 · GHSA-2vp2-8m5j-4rjx · GO-2025-3625 · Published 16/08/2019 · updated 17/06/2026

En resumen

CVE-2019-15119 es una vulnerabilidad MEDIO (CVSS 5.5) que afecta a ehang.io/nps, github.com/cnlh/nps, nps (ehang-io).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.95%, mayor que el 61.6% de las vulnerabilidades.
Solución: actualizar a 0.23.2 o posterior.

Package	Affected versions	Patched versions
ehang.io/nps Go	`< 0.23.2`	`0.23.2`
github.com/cnlh/nps Go	`< 0.23.2`	`0.23.2`
nps ehang-io	`≤ 0.23.2`	No fix yet

Description

lib/install/install.go in cnlh nps prior to 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.

NVD description

lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.

References

nvd.nist.gov/vuln/detail/CVE-2019-15119 · ADVISORY
cnlh/nps · WEB
cnlh/nps commit 7178b33 · WEB
cnlh/nps · PACKAGE
GitHub Advisory GHSA-2vp2-8m5j-4rjx · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free