Incorrect Default Permissions in log4js

Description

Default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config.

Recommendation

Update the log4js package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.4.0
• Patched version(s): 6.4.0

References

• GHSA-82v2-mx6x-wq7q
• lists.debian.org
• CVE-2022-21704
• CWE-276
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• tarteaucitron Cross-site Scripting (XSS) - CVE-2025-1467
• Cross site scripting in markdown-to-jsx - CVE-2024-21535
• uPlot Prototype Pollution vulnerability - CVE-2024-21489
• FUXA local file inclusion vulnerability - CVE-2023-31718

Tags:

npm

log4js