GHSA-82v2-mx6x-wq7q is a medium-severity (CVSS 5.5) Incorrect Default Permissions vulnerability in log4js. A fix is available for log4js — see the affected versions and patch details below.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-82v2-mx6x-wq7q by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,738 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
log4jsnpmDescription
Impact
Default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config.
Patches
Fixed by:
- https://github.com/log4js-node/log4js-node/pull/1141
- https://github.com/log4js-node/streamroller/pull/87
Released to NPM in [email protected]
Workarounds
Every version of log4js published allows passing the mode parameter to the configuration of file appenders, see the documentation for details.
References
Thanks to ranjit-git for raising the issue, and to @lamweili for fixing the problem.
For more information
If you have any questions or comments about this advisory:
- Open an issue in logj4s-node
- Ask a question in the slack channel
- Email us at [email protected]
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | log4js | all versions | 6.4.0npm install log4js@6.4.0 |
Affected Products
debian linuxdebianlog4jslog4js_projectDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for log4js, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update log4js to 6.4.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-82v2-mx6x-wq7q is resolved across your whole dependency graph.
Workarounds
Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.
Frequently Asked Questions
Is GHSA-82v2-mx6x-wq7q in your dependencies?
Find it across npm, including transitive dependencies.