Path traversal in bin-links - #VU23919
Published: January 3, 2020
Vulnerability identifier: #VU23919
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences, which allows attackers to create arbitrary files in the system outside of the intended node_modules folder through the bin field.
Affected software
bin-links
Remediation
Update to version 1.1.5.
bin-links - update to 1.1.5