T3MP3ST v1 — hardened launch (AGPL, verify-claims 24/24, leak-scrubbed)

bench/cve-zero/results/hunt-GHSA-ph9p-34f9-6g65.json

@@ -1 +1 @@
-{"id": "GHSA-ph9p-34f9-6g65", "cve": "CVE-2026-44705", "repo": "raszi/node-tmp", "cwes": ["CWE-22"], "vuln_files": ["lib/tmp.js"], "duration_sec": 100.3, "error": null, "strict": true, "lenient": true, "findings_scored": [{"fileMatch": true, "lineProx": true, "cweMatch": true, "hit": true, "title": "Path traversal / arbitrary file & directory write outside tmpdir via prefix-only startsWith check", "file": "lib/tmp.js", "line": 581, "cwe": "CWE-22"}], "n_findings": 1, "findings": [{"title": "Path traversal / arbitrary file & directory write outside tmpdir via prefix-only startsWith check", "file": "lib/tmp.js", "line": 581, "cwe": "CWE-22", "vuln_class": "path-traversal", "severity": "high", "description": "The containment check in _getRelativePath (line 581) and its sync twin _getRelativePathSync (line 600) validates that a user-supplied 'dir', 'template' or 'name' option stays inside tmpDir using `resolvedPath.startsWith(tmpDir)`. This is a prefix match without a trailing path separator. An attacker-controlled `dir` (e.g. '../<tmpDirBasename>EVIL/sub') resolves (via path.join(tmpDir, name) + fs.realpath in _resolvePath/_resolvePathSync) to a SIBLING directory whose absolute path begins with the tmpDir string but is NOT actually inside tmpDir. For tmpDir '/tmp/realtmp', resolvedPath '/tmp/realtmpEVIL/pwned' satisfies startsWith(tmpDir) === true, so the check passes. The (escaped) relative path is then stored as options.dir and used by _generateTmpName -> path.join(tmpDir, opts.dir, name), causing fs.open (file/fileSync), fs.mkdir (dir/dirSync), and especially the recursive rimraf/FN_RIMRAF_SYNC removal used with unsafeCleanup to operate on a location OUTSIDE the temp directory the consumer intended to confine operations to. Verified empirically: resolvedPath '/tmp/realtmpEVIL/pwned'.startsWith('/tmp/realtmp') === true.", "poc": "const tmp = require('tmp'); // assume os.tmpdir() realpaths to '/private/tmp' or any dir; create sibling sharing prefix\n// tmpDir basename is e.g. 'mytmp' -> attacker provides a dir option escaping to a prefix-sharing sibling\ntmp.dirSync({ tmpdir: '/tmp/mytmpEVIL/inner', unsafeCleanup: true });\n// The startsWith('/tmp/tmp/inner',\n// so node-tmp creates (and on cleanup recursively rm -rf's) a directory OUTSIDE the intended tmpDir.\n// Equivalent file write: tmp.fileSync({ tmpdir:'/t/mytmp', name:undefined, dir:'../mytmpEVIL/x', template:'fileXXXXXX' });", "confidence": 0.85}], "transcript": ""}
+{"id": "GHSA-ph9p-34f9-6g65", "cve": "CVE-2026-44705", "repo": "raszi/node-tmp", "cwes": ["CWE-22"], "vuln_files": ["lib/tmp.js"], "duration_sec": 48, "error": null, "strict": true, "lenient": true, "findings_scored": [{"fileMatch": true, "lineProx": true, "cweMatch": true, "hit": true, "title": "Path traversal / arbitrary file & directory creation via insufficient tmpDir boundary check (startsWith)", "file": "lib/tmp.js", "line": 581, "cwe": "CWE-22"}], "n_findings": 1, "findings": [{"title": "Path traversal / arbitrary file & directory creation via insufficient tmpDir boundary check (startsWith)", "file": "lib/tmp.js", "line": 581, "cwe": "CWE-22", "vuln_class": "path-traversal", "severity": "high", "description": "The containment check that is supposed to keep the resolved `dir`/`template`/`name` inside the temp root uses a bare string prefix test `resolvedPath.startsWith(tmpDir)` (line 581 in the async `_getRelativePath`, and identically line 600 in `_getRelativePathSync`). This does not enforce a path-separator boundary. Because `tmpDir` is derived from `fs.realpath(os.tmpdir())` (e.g. `/tmp`), any resolved path that merely shares that string prefix \u2014 such as the sibling directory `/tmpXXXX` reached via `dir: '../tmpXXXX'` \u2014 passes the check even though it lies OUTSIDE the temp root. The attacker-controlled `options.dir` (and `options.template`/`options.name`) flow: dir()/file()/dirSync()/fileSync() -> _assertAndSanitizeOptions[Sync] -> _getRelativePath[Sync]('dir', options.dir, tmpDir) -> _resolvePath (which joins `../tmpXXXX` onto tmpDir producing `/tmpXXXX` and returns realpath of its parent) -> the flawed startsWith gate. The escaped relative path is then stored in options.dir and consumed by _generateTmpName via `path.join(tmpDir, opts.dir, name)`, after which fs.mkdir / fs.open create a directory/file at the escaped location. Combined with symlinks under the tmp dir (which fs.realpath follows in _resolvePath), an attacker who controls the dir/template option can cause files/directories to be created outside the intended temp root (arbitrary write / directory creation, potential overwrite/cleanup outside tmp). This is CVE-2025-54798. The correct check must append path.sep (e.g. `resolvedPath !== tmpDir && !resolvedPath.startsWith(tmpDir + path.sep)`).", "poc": "Assume os.tmpdir() resolves to /tmp and a sibling dir /tmpbackdoor exists (or create the escape via a symlink placed inside /tmp). Call: require('tmp').dirSync({ dir: '../tmpbackdoor' })  \u2014 _resolvePathSync yields /tmpbackdoor, path.relative('/tmp','/tmpbackdoor') = '../tmpbackdoor', and '/tmpbackdoor'.startsWith('/tmp') === true, so the guard is bypassed and fs.mkdirSync creates a directory outside the temp root. Same works for tmp.fileSync({ template: '../tmpbackdoorXXXXXX' }) to create a file outside /tmp.", "confidence": 0.9}], "transcript": ""}