Path Traversal Vulnerability in Node.js Libraries

CVE-2023-39332

What is CVE-2023-39332?

A path traversal vulnerability exists in Node.js due to improper handling of Uint8Array objects in file system operations. While Node.js includes protections against path traversal for strings and Buffer objects, it fails to implement similar safeguards for non-Buffer Uint8Array instances. This allows attackers to exploit file access pathways beyond intended directories, posing significant security risks. The vulnerability emerges amid the experimental permission model in Node.js, which heightens the need for caution in applications utilizing these features.

References