A vulnerability in the Node.js Permissions model allows local attackers to bypass file system access restrictions, potentially leading to unauthorized read and write access to sensitive files.

The flaw exists in the Node.js Permissions model, which fails to properly validate relative symlink paths when using the --allow-fs-read or --allow-fs-write flags. An attacker with low-privileged local access can manipulate symlinks to escape intended path restrictions and access files outside of the authorized directory.

The ability to perform arbitrary file read or write operations poses a significant risk to data confidentiality and system integrity. With a CVSS score of 7.1, this vulnerability is classified as High, as it allows a compromised local process to escalate its impact by accessing sensitive configuration files, credentials, or system data that should have been protected by the sandbox.

Immediate Action: Update Node.js to the latest security release as specified in the official vendor advisory to incorporate the necessary path validation fixes.

Proactive Monitoring: Monitor server logs for unusual file access patterns or unexpected attempts to create or traverse symlinks within restricted directories.

Compensating Controls: Ensure that the Principle of Least Privilege is strictly enforced at the operating system level, limiting the permissions of the user account running the Node.js application to prevent access to sensitive areas of the file system.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Given the High severity of this vulnerability and the existence of a public proof-of-concept, it is imperative that organizations prioritize patching their Node.js environments. Administrators should immediately verify their installed versions and apply the security updates provided by the Node.js project to ensure that the Permissions model correctly enforces file system isolation.