WS-2019-0337 (Medium) detected in bin-links-1.1.2.tgz - autoclosed

[mend-bolt-for-github[bot]]

WS-2019-0337 - Medium Severity Vulnerability

Vulnerable Library - bin-links-1.1.2.tgz

JavaScript package binary linker

Library home page: https://registry.npmjs.org/bin-links/-/bin-links-1.1.2.tgz

Path to dependency file: shipengine-request/package.json

Path to vulnerable library: shipengine-request/node_modules/npm/node_modules/bin-links/package.json

Dependency Hierarchy: - semantic-release-15.14.0.tgz (Root Library) - npm-5.1.7.tgz - npm-6.9.0.tgz - :x: **bin-links-1.1.2.tgz** (Vulnerable Library)

Found in HEAD commit: 15587aaa22c58ec0b1877768dc8c7f1c43a47116

Vulnerability Details

Arbitrary File Write vulnerability found in bin-links before 1.1.5. The package fails to restrict access to folders outside of the intended node_modules folder through the bin field. This allows attackers to create arbitrary files in the system.

Publish Date: 2019-12-11

URL: WS-2019-0337

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://github.com/npm/bin-links/commit/642cd1890d1e0ca32b5f9ceadc6a587d94a63d69

Release Date: 2019-12-17

Fix Resolution: bin-links - 1.1.5

---

Step up your Open Source Security Game with WhiteSource here

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.