CVE-2023-30583

2024-09-0716:00:35

hackerone

www.cve.org

security flaw

file system

node.js

EPSS

Percentile

9.5%

JSON

fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob() API.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Node.js",
    "product": "Node.js",
    "versions": [
      {
        "version": "20.3.1",
        "status": "affected",
        "lessThan": "20.3.1",
        "versionType": "semver"
      }
    ]
  }
]

References

nodejs.org/en/blog/vulnerability/june-2023-security-releases

CVE-2023-30583

CNA Affected

References

Related