Executive brief
humanfs is a Node.js library for cross-platform file system operations. During recursive copy operations, the library dereferences symbolic links instead of treating them as links, allowing an attacker to read and copy files outside the intended source directory. An application copying an attacker-controlled directory could inadvertently leak sensitive files readable by the process.
Technical details
The vulnerability exists in @humanfs/node's copyAll() and copy() functions, which fail to handle symlinks as a special case. During recursive directory copies, the code ignores symlink state information exposed by the list() function and passes all non-directory entries to copy(), which delegates to fs.promises.copyFile(). On Node.js, copyFile() automatically dereferences symlinks, causing the destination to receive the contents of the symlink target rather than the link itself. This breaks the directory boundary and allows copying of files outside the source tree. The vulnerability requires the attacker to control the source tree contents (placing a malicious symlink) and the application to invoke copyAll() or copy() on that attacker-controlled path. The fix is available in version 0.16.8 and later.
Affected products
- humanwhocodes humanfs <0.16.8
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Fixed in version 0.16.8