CVE-2023-30583

2024-09-0716:00:35

hackerone

github.com

cve-2023-30583

experimental feature

missing check

file system read restriction

node.js

AI Score

6.2

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob() API.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*"
    ],
    "vendor": "nodejs",
    "product": "nodejs",
    "versions": [
      {
        "status": "affected",
        "version": "20.0",
        "lessThan": "20.3.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]