GHSA-gqf6-75v8-vr26
Arbitrary File Write in bin-links
Versions of bin-links prior to 1.1.5 are vulnerable to an Arbitrary File Write. The package fails to restrict access to folders outside of the intended node_modules folder through the bin field. This allows attackers to create arbitrary files in the system. Note it is not possible to overwrite files that already exist.
Recommendation
Upgrade to version 1.1.5 or later.
What each source reports
GitHub AdvisoriesNo score
Arbitrary File Write in bin-links
Versions of bin-links prior to 1.1.5 are vulnerable to an Arbitrary File Write. The package fails to restrict access to folders outside of the intended node_modules folder through the bin field. This allows attackers to create arbitrary files in the system. Note it is not possible to overwrite files that already exist.
Recommendation
Upgrade to version 1.1.5 or later.
- Record
GHSA-gqf6-75v8-vr26- Updated
- 2026-11-02
OSVNo score
Arbitrary File Write in bin-links
Versions of bin-links prior to 1.1.5 are vulnerable to an Arbitrary File Write. The package fails to restrict access to folders outside of the intended node_modules folder through the bin field. This allows attackers to create arbitrary files in the system. Note it is not possible to overwrite files that already exist.
Recommendation
Upgrade to version 1.1.5 or later.
- Record
GHSA-gqf6-75v8-vr26- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bin-linksnpm | before 1.1.5 | 1.1.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-gqf6-75v8-vr26 is a vulnerability with no CVSS score yet in bin-links, published September 4, 2020. No source lists public exploit code. Fixed in bin-links 1.1.5.