Vulnerabilities

The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user.

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path.

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through pat…