fs.openAsBlob() Vulnerability Allows Bypass of Experimental Permission Model in Node.js 20

CVE-2023-30583

What is CVE-2023-30583?

A vulnerability has been identified in Node.js that affects the fs.openAsBlob() API, which can bypass the experimental permission model intended for file system read restrictions. This issue occurs when the --allow-fs-read flag is enabled, leading to unauthorized access to the file system. As this permission model is still experimental, the missing validation check in the fs.openAsBlob() function presents potential security risks for applications using Node.js 20, which could allow attackers to exploit file system operations without adequate permissions.

References