Medium, CVSS 5.7npmPublished
humanfs: Recursive copy follows symlinked files and copies data from outside the source tree
GHSA-p498-v437-472g
- Affected
- npm @humanfs/node < 0.16.8
- Fixed in
- 0.16.8· Vendor fix available
- Issue
- @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll() read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details The Node implementation exposes symlink state through list(), but copyAll() ignores it. During recursive copies, every non-directory entry is passed to copy(), which delegates to fs.promises.copyFile(). On Node, copyFile() dereferences symlinks. As a result, a symlink inside the copied tree is handled as if it were an ordinary file, and the destination receives the contents of the symlink target rather than a copy of the link itself. That breaks the expected boundary of a directory copy. A caller can point copyAll() at a seemingly self-contained directory and still end up copying data from elsewhere on the host filesystem if the source tree contains attacker-supplied symlinks. The same…
Recommended action: Upgrade to 0.16.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.