CVE-2023-30584

2024-09-0716:00:35

hackerone

github.com

node.js

vulnerability

experimental

permission model

path traversal bypass

file permissions

AI Score

6.2

Confidence

Low

EPSS

Percentile

11.1%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*"
    ],
    "vendor": "nodejs",
    "product": "nodejs",
    "versions": [
      {
        "status": "affected",
        "version": "20.0",
        "lessThan": "20.3.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]