REDHAT-BUG-2431352: High severity npm/node vulnerability
A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2431352?
The severity of REDHAT-BUG-2431352 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2431352?
To fix REDHAT-BUG-2431352, update your Node.js and npm to the latest versions that address this vulnerability.
What software is affected by REDHAT-BUG-2431352?
The software affected by REDHAT-BUG-2431352 includes Node.js and npm.
What is the risk associated with REDHAT-BUG-2431352?
The risk associated with REDHAT-BUG-2431352 is rated at 33, indicating a significant potential for exploitation.
How does REDHAT-BUG-2431352 impact file system security?
REDHAT-BUG-2431352 allows attackers to bypass file access restrictions, potentially leading to unauthorized access of sensitive files.