Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-7xhv-hcmf-4rfv

Опубликовано: 20 янв. 2026
Источник: github
Github: Не прошло ревью
CVSS3: 5.8

Описание

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.

  • The issue affects users of the Node.js permission model on version v25.

In the moment of this vulnerability, network permissions (--allow-net) are still in the experimental phase.

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when --permission is enabled. Even without --allow-net, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.

  • The issue affects users of the Node.js permission model on version v25.

In the moment of this vulnerability, network permissions (--allow-net) are still in the experimental phase.

EPSS

Процентиль: 8%
0.00029
Низкий

5.8 Medium

CVSS3

Дефекты

CWE-284

Связанные уязвимости

CVSS3: 10
ubuntu
15 дней назад

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.

CVSS3: 10
nvd
15 дней назад

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution. * The issue affects users of the Node.js permission model on version v25. In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.

CVSS3: 10
debian
15 дней назад

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) c ...

EPSS

Процентиль: 8%
0.00029
Низкий

5.8 Medium

CVSS3

Дефекты

CWE-284