Permission Model Vulnerability in Node.js by OpenJS Foundation

CVE-2023-32005

What is CVE-2023-32005?

A security flaw has been identified in Node.js version 20, specifically affecting the experimental permission model when the --allow-fs-read flag is incorrectly applied to non-* arguments. This issue arises due to inadequate restrictions within the permission model, allowing unauthorized access to file statistics via the fs.statfs API. As a consequence, malicious users may access file stats without having the necessary read permissions. This vulnerability poses risks particularly to those utilizing the experimental permission model.

References