Node.js Experimental Permission Model Vulnerability Affects All Users

CVE-2024-21896

What is CVE-2024-21896?

A significant security vulnerability arises from the way Node.js handles its permission model. By utilizing user-supplied paths and the path.resolve() function, there is a risk of path traversal attacks. The issue is exacerbated when the path is processed as a Buffer, where alterations via Buffer.prototype.utf8Write can manipulate the outcome of path.resolve(). This flaw primarily affects users operating under the experimental permission model in Node.js versions 20 and 21, emphasizing the need for caution when implementing this feature.

References