Executive brief
jsdom is a Node.js JavaScript DOM implementation used by developers to test and run web pages in server-side environments. The library improperly allowed loading of local file resources (file:// URIs) when resource loading was enabled, potentially allowing a malicious web page to access local files on the server running jsdom. This advisory has been withdrawn because jsdom requires explicit configuration to enable this behavior.
Technical details
jsdom is vulnerable to insufficient granularity of access control (CWE-1220) in its resource loading mechanism. When the `resources` option is set to "usable" to enable loading of external resources, jsdom fails to restrict access to local file:// URIs, allowing code running within the DOM to attempt to load arbitrary local files. The vulnerability requires an attacker to supply malicious HTML/JavaScript to a jsdom instance with `resources: "usable"` enabled. Exploitation could lead to information disclosure of local files accessible to the process. The vulnerability was fixed in version 16.5.0 and later, though the advisory was withdrawn in 2024 because the default jsdom configuration does not enable resource loading and users must explicitly opt-in to this behavior.
Affected products
- jsdom jsdom <= 16.4.0
Timeline
- 2021-02-16: disclosed
- 2021: patched: Fixed in version 16.5.0
- 2024-07-19: other: Advisory withdrawn