Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Versions of bin-links prior to 1.1.6 are vulnerable to a Global nodemodules Binary Overwrite. It fails to prevent globally-installed binaries to be overwritten by other package installs. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the first binary. This behavior is still allowed in local installations. Recommendation Upgrade to version 1.1.6 or later.
Recommended action: Upgrade to 1.1.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of bin-links prior to 1.1.5 are vulnerable to a Symlink reference outside of nodemodules. It is possible to create symlinks to files outside of thenodemodules folder through the bin field. This may allow attackers to access unauthorized files. Recommendation Upgrade to version 1.1.5 or later.
Recommended action: Upgrade to 1.1.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of bin-links prior to 1.1.5 are vulnerable to an Arbitrary File Write. The package fails to restrict access to folders outside of the intended nodemodules folder through the bin field. This allows attackers to create arbitrary files in the system. Note it is not possible to overwrite files that already exist. Recommendation Upgrade to version 1.1.5 or later.
Recommended action: Upgrade to 1.1.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.