Executive brief
The bin-links library, which is used by the npm package manager to create executable links for software packages, contains a flaw in how it handles file shortcuts. An attacker could potentially use a specially crafted package to create links to sensitive files outside of the intended installation folder. This could lead to unauthorized access to system files or data on the machine where the package is being installed.
Technical details
Versions of bin-links prior to 1.1.5 are vulnerable to an arbitrary symlink creation flaw. The vulnerability exists in the processing of the 'bin' field within a package's configuration, which fails to properly validate that the target of a symbolic link remains within the expected node_modules directory. A local attacker or a malicious package could exploit this to create symlinks pointing to sensitive files elsewhere on the file system. This issue is resolved in version 1.1.5.
Affected products
- npm bin-links < 1.1.5
Timeline
- 2020-08-31: patched: Fix released in version 1.1.5
- 2020-09-04: disclosed: Advisory published via GitHub Advisory Database