A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

A flaw in Node.js\u2019s Permissions model allows attackers to bypass ...

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

Уязвимость программной платформы Node.js, связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю скомпрометировать систему

Important: nodejs:20 security update

Important: nodejs:22 security update

Important: nodejs:24 security update

Important: nodejs:20 security update

Important: nodejs:22 security update

Important: nodejs:24 security update

Important: nodejs22 security update

Important: nodejs24 security update

ELSA-2026-2783: nodejs:20 security update (IMPORTANT)

ELSA-2026-2782: nodejs:22 security update (IMPORTANT)

ELSA-2026-2781: nodejs:24 security update (IMPORTANT)

ELSA-2026-2422: nodejs:20 security update (IMPORTANT)

ELSA-2026-2421: nodejs:22 security update (IMPORTANT)

ELSA-2026-2420: nodejs:24 security update (IMPORTANT)