A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| nodejs | node | 20.20.1 – ≤ 20.20.1, 22.22.1 – ≤ 22.22.1, 24.14.0 – ≤ 24.14.0, 25.8.1 – ≤ 25.8.1, 4.0 – < 4.*, 5.0 – < 5.*, 6.0 – < 6.*, 7.0 – < 7.*, 8.0 – < 8.*, 9.0 – < 9.*, 10.0 – < 10.*, 11.0 – < 11.*, 12.0 – < 12.*, 13.0 – < 13.*, 14.0 – < 14.*, 15.0 – < 15.*, 16.0 – < 16.*, 17.0 – < 17.*, 18.0 – < 18.*, 19.0 – < 19.* | |
| nodejs | node.js | ≤ 20.20.1 |
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≤ 20.20.1cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 22.0.0 ≤ 22.22.1cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 24.0.0 ≤ 24.14.0cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* ≥ 25.0.0 ≤ 25.8.1Nuestro sensor honeypot gratuito y de código abierto espera en puertos que su servidor no usa y reporta a una lista compartida los escáneres y atacantes que se conectan.