The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ```
will ignore `pub` and give access to everything after `.ssh/`.
This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- CVSS 3.0 Base Score: 5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-packaging-bundler | Apr 11, 2024 | Feb 20, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs20-libs-debuginfoUpgrade nodejs20-develUpgrade nodejs20-debugsourceUpgrade v8-11.3-develUpgrade nodejs20-npmUpgrade nodejs20-full-i18nUpgrade nodejs20-debuginfoUpgrade nodejs20Upgrade nodejs20-docsUpgrade nodejs20-libs | Feb 17, 2025 | Feb 19, 2024 |
| Freebsd | — | Upgrade node16Upgrade nodeUpgrade node20Upgrade node21Upgrade node18 | Mar 2, 2024 | Mar 1, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Feb 20, 2024 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-packaging-bundler | Apr 9, 2024 | Feb 19, 2024 |
| Redhat_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-full-i18n | Apr 9, 2024 | Feb 20, 2024 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-debugsource | May 8, 2024 | Feb 20, 2024 |
| Suse | — | Upgrade nodejs20-develUpgrade corepack20Upgrade npm20Upgrade nodejs20Upgrade nodejs20-docs | Feb 29, 2024 | Feb 20, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Feb 20, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub