THREATOPS
THREAT OPSThreat News › [GHSA] GHSA-p498-v437-472g (medium) — humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

[GHSA] GHSA-p498-v437-472g (medium) — humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

medgithub_advisoriesPublished 2026-09-02

GHSA-p498-v437-472g Severity: medium CVE: None

humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

### Summary

`@humanfs/node` does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make `copyAll()` read and copy the contents of any file readable by the process, even when that fil

Original source: https://github.com/advisories/GHSA-p498-v437-472g