GMS-2020-105: Global node_modules Binary Overwrite in bin-links

September 4, 2020

Versions of bin-links are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent globally-installed binaries to be overwritten by other package installs. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the first binary. This behavior is still allowed in local installations.

References

github.com/advisories/GHSA-v45m-2wcp-gg98
www.npmjs.com/advisories/1438

Code Behaviors & Features

Detect and mitigate GMS-2020-105 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →