Dinky npm Package Vulnerability: Critical Arbitrary File Write Risk
An early warning has been issued regarding a critical vulnerability in the Dinky npm package, versions <=1.2.5, which reportedly allows arbitrary file writes due to insufficient path validation.
What happened
The vulnerability, tracked as CVE-2026-70558 with a CVSS score of 9.8, affects Dinky's POST /download/uploadFromRsByLocal handler. This handler appears to pass the caller-supplied path parameter directly to file operations without proper validation, enabling an attacker to write arbitrary files as the Dinky service account. The vulnerability is compounded by the fact that the route is not properly guarded, with only a header equality check against a hardcoded token providing minimal security. The default Docker image for Dinky runs with permissive settings, further exacerbating the risk. It is under investigation how this vulnerability might be exploited in real-world scenarios, but demonstrated impacts include overwriting critical files such as /opt/dinky/config/static/index.html to serve malicious JavaScript to admin users.
Professional software engineers using Dinky in their projects are advised to assess their exposure to this vulnerability. It is recommended to upgrade to a patched version of Dinky once it becomes available and to review systems for any signs of unauthorized file writes. Given the severity of this vulnerability, immediate action is advised to mitigate potential risks.
How 0Day mitigates this
dinky is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.