tmp (npm)
Temporary file and directory creator for node.js
Advisories
6
Latest version
0.2.7
Released May 27, 2026
License
MIT
OpenSSF Scorecard
3.4 / 10
How to fix
Upgrading to 0.2.7 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install tmp@0.2.7yarn
yarn add tmp@0.2.7pnpm
pnpm add tmp@0.2.7Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-7c78-jf6q-g5cm tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template |
High EPSS 0.50% |
>= 0.2.6, < 0.2.7 | 0.2.7 |
| GHSA-7c78-jf6q-g5cm tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template |
High EPSS 0.50% |
>= 0.2.6, < 0.2.7 | 0.2.7 |
| GHSA-ph9p-34f9-6g65 tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape |
High EPSS 0.43% |
< 0.2.6 | 0.2.6 |
| GHSA-ph9p-34f9-6g65 tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape |
High EPSS 0.43% |
< 0.2.6 | 0.2.6 |
| GHSA-52f5-9888-hmc6 tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter |
Medium EPSS 0.38% |
< 0.2.4 | 0.2.4 |
| GHSA-52f5-9888-hmc6 tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter |
Medium EPSS 0.38% |
<= 0.2.3 | No fix yet |
Source: git+https://github.com/raszi/node-tmp.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor