Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions

A flaw was found in Node.js. The Node.js Permission Model, intended to restrict filesystem access, does not properly enforce read permission checks for the fs.realpathSync.native function. This vulnerability allows code operating under --permission with restricted --allow-fs-read flags to bypass...

Node.js 安全漏洞

Node.js is an open-source, cross-platform JavaScript runtime environment developed by the Node.js community. Security vulnerabilities exist in Node.js versions 20.x, 22.x, 24.x, and 25.x. These vulnerabilities stem from a lack of permission checks for the fs.realpathSync.native method during the...

Path Traversal

Node.js is vulnerable to Path Traversal. The vulnerability is due to improper validation of relative symlink paths in the permissions model, allowing attackers to chain directories and symlinks to bypass --allow-fs-read and --allow-fs-write restrictions and access files outside the permitted...

BIT-NODE-MIN-2025-55130

A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files...

CVE-2025-55130

A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files...

Node.js security vulnerabilities

Node.js is an open-source, cross-platform JavaScript runtime environment developed by the Node.js community. Versions 20, 22, 24, and 25 of Node.js contain security vulnerabilities. These vulnerabilities stem from flaws in the permission model, which could allow attackers to bypass file system...

CVE-2019-11628

An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3,...

EUVD-2018-15870

Malware in sbrugna...

EUVD-2017-5332

Malware in sbrugna...

EUVD-2018-15924

Malware in sbrugna...

EUVD-2017-5357

Malware in sbrugna...

EUVD-2017-11690

Malware in sbrugna...

EUVD-2017-5355

Malware in sbrugna...

EUVD-2018-15878

Malware in sbrugna...

EUVD-2017-16102

Malware in sbrugna...

EUVD-2017-5336

Malware in sbrugna...

EUVD-2017-5356

Malware in sbrugna...

EUVD-2017-16083

Malware in sbrugna...

EUVD-2017-16192

Malware in sbrugna...

EUVD-2017-16028

Malware in sbrugna...