GHSA-2mj8-pj3j-h362
Symlink reference outside of node_modules in bin-links
Versions of bin-links prior to 1.1.5 are vulnerable to a Symlink reference outside of node_modules. It is possible to create symlinks to files outside of thenode_modules folder through the bin field. This may allow attackers to access unauthorized files.
Recommendation
Upgrade to version 1.1.5 or later.
What each source reports
GitHub AdvisoriesNo score
Symlink reference outside of node_modules in bin-links
Versions of bin-links prior to 1.1.5 are vulnerable to a Symlink reference outside of node_modules. It is possible to create symlinks to files outside of thenode_modules folder through the bin field. This may allow attackers to access unauthorized files.
Recommendation
Upgrade to version 1.1.5 or later.
- Record
GHSA-2mj8-pj3j-h362- Updated
- 2026-11-02
OSVNo score
Symlink reference outside of node_modules in bin-links
Versions of bin-links prior to 1.1.5 are vulnerable to a Symlink reference outside of node_modules. It is possible to create symlinks to files outside of thenode_modules folder through the bin field. This may allow attackers to access unauthorized files.
Recommendation
Upgrade to version 1.1.5 or later.
- Record
GHSA-2mj8-pj3j-h362- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bin-linksnpm | before 1.1.5 | 1.1.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-2mj8-pj3j-h362 is a vulnerability with no CVSS score yet in bin-links, published September 4, 2020. No source lists public exploit code. Fixed in bin-links 1.1.5.