🎯 New Report #3761342: Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant
🔺Severity: High
👽 Reporter: sy2n0
⭐️ Reputation: 153
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-05-25
⏰ Disclosed: 2026-07-29 23:00:05
📝 Summary: A flaw was discovered in the Node.js Permission Model's enforcement of filesystem access control. The vulnerability could allow an attacker granted access to one path to read from or write to paths outside the intended filesystem allowlist, due to issues with the radix-tree prefix-boundary handling. This affected Node.js versions in the main, 22.x, 24.x, and 26.x branches.
📂 Report JSON File: 3761342
@hackeronereports