Skip to content
Fencer Intel
low —

GHSA-v45m-2wcp-gg98 json

Global node_modules Binary Overwrite in bin-links

published 6y ago modified 6y ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

Versions of `bin-links` prior to 1.1.6 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent globally-installed binaries to be overwritten by other package installs. For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This behavior is still allowed in local installations.

## Recommendation

Upgrade to version 1.1.6 or later.

Patch / fix

  • npm bin-links 1.1.6

Is GHSA-v45m-2wcp-gg98 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
npm bin-links
<1.1.6
1.1.6

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.