REDHAT-BUG-2453152: Low severity OpenJS Foundation Node.js vulnerability
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync.native() without the required read permission checks, while all comparable filesystem functions correctly enforce them.
As a result, code running under --permission with restricted --allow-fs-read can still use fs.realpathSync.native() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.
This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-read is intentionally restricted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until patched, avoid using the Node.js Permission Model with restricted `--allow-fs-read` in cases where untrusted code could call `fs.realpathSync.native()` (since it can still check file existence, resolve symlink targets, and enumerate filesystem paths outside permitted directories).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2453152?
The severity of REDHAT-BUG-2453152 is classified as low.
What is the main issue described in REDHAT-BUG-2453152?
REDHAT-BUG-2453152 details a flaw in Node.js's filesystem enforcement that allows `fs.realpathSync.native()` to bypass necessary read permission checks.
How does REDHAT-BUG-2453152 affect Node.js applications?
This vulnerability can allow code running with restricted permissions to access filesystem functions without proper checks.
What versions of Node.js are impacted by REDHAT-BUG-2453152?
The specific affected versions are not detailed in the provided information, but it is pertinent for users running Node.js under the mentioned permissions.
How can I mitigate the risks associated with REDHAT-BUG-2453152?
To mitigate risks, avoid using the `fs.realpathSync.native()` function in environments where strict permission enforcement is crucial.