CVE:CVE-2021-39134
CNNVD:CNNVD-202108-2752
NPM arborist是美国npm（NPM）公司的一个软件包。用于可视化存储为平面列表的分层数据。
arborist 存在后置链接漏洞，该漏洞允许攻击者进行任意文件创建、任意文件覆盖和任意代码执行。
solution:Upgrade npmjs arborist to a higher version than 2.8.2,and avoid the version (,2.8.2); Upgrade oracle graalvm to a higher version than 20.3.3,21.2.0,and avoid the version 20.3.3,21.2.0; Upgrade siemens sinec_infrastructure_network_services to a higher version than 1.0.1.1,and avoid the version (,1.0.1.1)