BIT-node-2023-30582

BIT-node-2023-30582 PUBLISHED CVSS 5.300000190734863 MEDIUM

A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument. This flaw arises from an inadequate permission model that fails to restrict file watching through the fs.watchFile API. As a result, malicious actors can monitor files that they do not have explicit read access to. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Risk Scores

CVSS v3.1

5.300000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Products

Vendor	Product	Versions
Bitnami	node	20.0.0, 20.0.0, 20.0.0

Timeline

Sep 10, 2024 CVE Published
Apr 3, 2025 CVE Updated

References

https://nodejs.org/en/blog/vulnerability/june-2023-security-releases url
https://security.netapp.com/advisory/ntap-20240926-0007/ url
https://nvd.nist.gov/vuln/detail/CVE-2023-30582 url

Open in Interactive Console →