Executive brief
The @humanfs/node library, used for file system operations in Node.js applications, improperly handles symbolic links during copy operations. An attacker who controls the source directory can place symlinks that point outside the directory tree, causing the copyAll() and copy() functions to read and expose arbitrary files from the host system that the application process can access. This turns routine file copying, export, or packaging operations into a data disclosure vulnerability.
Technical details
The vulnerability is a path traversal issue (CWE-22) in the @humanfs/node library's copy operations. The Node.js copyFile() API dereferences symlinks by default, but the humanfs library does not check for or handle symlinks separately during recursive directory copies. When copyAll() iterates through directory contents, it passes every non-directory entry (including symlinks) to copy(), which delegates to fs.promises.copyFile(). Because copyFile() follows symlinks, a malicious symlink can point to any readable file on the system, and the destination receives the symlink target's contents rather than a copy of the link itself. The attack requires the attacker to control the source directory contents, and exploitation has no privilege requirement or user interaction. The fix was released in version 0.16.8, which properly detects and handles symlinks as special cases during copy operations.
Affected products
- humanwhocodes @humanfs/node < 0.16.8
Timeline
- 2026-07-10: advisory: Advisory published by GitHub
- 2026-09-02: patched: Version 0.16.8 released with fix