49 matches found
npm Vulnerable to Global node_modules Binary Overwrite
Versions of the npm CLI prior to 6.13.4 are vulnerable to a Global nodemodules Binary Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent...
npm symlink reference outside of node_modules
Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of nodemodules. It is possible for packages to create symlinks to files outside of thenodemodules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would...
Unauthorized File Access
bin-links is vulnerable to unauthorized file access. The vulnerability exists as it was possible to use the bin field to create symlinks to files outside the nodemodules folder. Note: The vulnerability is fixed in 1.1.4, but an upgrade to 1.1.5 is favourable due to a bug in 1.1.4...
Global node_modules Binary Overwrite
Overview Versions of bin-links prior to 1.1.6 are vulnerable to a Global nodemodules Binary Overwrite. It fails to prevent globally-installed binaries to be overwritten by other package installs. For example, if a package was installed globally and created a serve binary, any subsequent installs ...
Global node_modules Binary Overwrite
Overview Versions of the npm CLI prior to 6.13.4 are vulnerable to a Global nodemodules Binary Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any...
Symlink reference outside of node_modules
Overview Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of nodemodules. It is possible for packages to create symlinks to files outside of thenodemodules folder through the bin field upon installation. A properly constructed entry in the package.json bin fie...
Rendertron discloses absolute paths of files
Installed packages are exposed by nodemodules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "where" attribute of package.json files...
GHSA-VQMR-957G-R7W3 Rendertron discloses absolute paths of files
Installed packages are exposed by nodemodules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "where" attribute of package.json files...
