High severity7.5NVD Advisory· Published Sep 7, 2024· Updated Apr 15, 2026
CVE-2023-30583
CVE-2023-30583
Description
fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob() API.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9- osv-coords7 versionspkg:apk/chainguard/nodejs-20pkg:apk/chainguard/nodejs-20-docpkg:apk/wolfi/nodejs-20pkg:apk/wolfi/nodejs-20-docpkg:bitnami/nodepkg:bitnami/node-minpkg:rpm/opensuse/nodejs20&distro=openSUSE%20Tumbleweed
< 20.3.1-r0+ 6 more
- (no CPE)range: < 20.3.1-r0
- (no CPE)range: < 20.3.1-r0
- (no CPE)range: < 20.3.1-r0
- (no CPE)range: < 20.3.1-r0
- (no CPE)range: >= 20.0.0, < 20.3.1
- (no CPE)range: >= 20.0.0, < 20.3.1
- (no CPE)range: < 20.3.1-1.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.