Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-30583

fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20. This flaw arises from a miss

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20. This flaw arises from a missing check in the `fs.openAsBlob()` API. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

NodeJS Node

Default version status: unaffected

  • 4.0 to < 4.*affected
  • 5.0 to < 5.*affected
  • 6.0 to < 6.*affected
  • 7.0 to < 7.*affected
  • 8.0 to < 8.*affected
  • 9.0 to < 9.*affected
  • 10.0 to < 10.*affected
  • 11.0 to < 11.*affected
  • 12.0 to < 12.*affected
  • 13.0 to < 13.*affected
  • 14.0 to < 14.*affected
  • 15.0 to < 15.*affected
  • 17.0 to < 17.*affected
  • 19.0 to < 19.*affected
  • 20.0 to < 20.3.1affected

References