CVE-2026-44705 Details

A path traversal vulnerability has been identified in the tmp npm package for Node.js, affecting all versions prior to 0.2.6. The vulnerability allows escaping the intended temporary directory when untrusted data is passed into the prefix, postfix, or dir options. By embedding traversal sequences or path separators, attackers can create files outside the designated temporary base directory, at locations controlled by the attacker, using the privileges of the running process. This issue arises in applications that do not properly sanitize user-controlled data before using tmp's file or directory creation functions.

To address this vulnerability, it is recommended to sanitize and validate user input before passing it to the tmp package. This can be done by removing path separators and traversal sequences from the prefix and postfix options, and by rejecting absolute paths or directories that escape the intended base directory. Additionally, implementing post-construction validation of the final file path can help ensure that it remains within the designated temporary directory.