Symlink reference outside of node_modules in bin-links
Summary
GHSA-2mj8-pj3j-h362: Symlink reference outside of node_modules in bin-links. Affects bin-links versions < 1.1.5. Fixed in 1.1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bin-links package is an npm package that is used to create symlinks to executable files in the node_modules folder. It allows developers to easily access and run these executables from the command line. However, versions of bin-links prior to 1.1.5 have a vulnerability that allows the creation of symlinks to files outside of the node_modules folder. This can potentially lead to unauthorized access to sensitive files.
Vulnerability Detail
The vulnerability in bin-links allows attackers to create symlinks to files outside of the node_modules folder through the bin field. By exploiting this vulnerability, an attacker can gain access to unauthorized files on the system. This can lead to the exposure of sensitive information or the execution of malicious code.
How To Fix
Minimum fixed version
1.1.5
This is the first release that contains the fix.
npm install bin-links@1.1.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The bin-links package prior to version 1.1.5 is vulnerable to a symlink reference outside of the node_modules folder. This can allow attackers to access unauthorized files on the system. It is highly recommended to upgrade to version 1.1.5 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for bin-links →
FAQ
This vulnerability allows attackers to access unauthorized files on the system, potentially leading to the exposure of sensitive information or the execution of malicious code.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for vulnerabilities.
At the moment, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version of the bin-links package.
There are no known public exploits for this vulnerability at the moment. However, it is still important to upgrade to the fixed version to prevent any potential attacks.
This vulnerability was discovered by the GitHub Security Lab.
References
Related vulnerabilities
Recent vulnerabilities recorded for bin-links.
