Path Traversal Vulnerability in Node.js 20 Experimental Permission Model

CVE-2023-32003

What is CVE-2023-32003?

A significant flaw has been identified in Node.js 20, affecting users of its experimental permission model. The vulnerability arises from the fs.mkdtemp() and fs.mkdtempSync() functions, which can be exploited through a path traversal attack. The lack of proper permission checks allows malicious actors to create arbitrary directories, which could lead to further exploitation within an application. This issue emphasizes the importance of robust permission checks, particularly in experimental features like the permission model of Node.js.

References