Skip to content

doc: clarify build environment is trusted in threat model #61865

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nodejs-github-bot merged 1 commit into from
Feb 19, 2026
+15 −0
Merged

doc: clarify build environment is trusted in threat model #61865

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
doc: clarify build environment is trusted in threat model 
Add build system attacks (command injection via environment
variables, path hijacking, file permissions) to the list of
non-vulnerabilities. The build environment is a trusted element
and these scenarios require an already-compromised system.
  • Loading branch information
@mcollina
mcollina committed Feb 17, 2026
commit 85e6c7b0ee160be8ec7b00ccbea710ca87492e98
15 changes: 15 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,6 +335,21 @@ the community they pose.
proper security boundaries between trusted application logic and untrusted
user input.

#### Build System Attacks Requiring Control of the Build Environment (CWE-78, CWE-114, CWE-276)

* The Node.js build system (e.g., `configure`, `configure.py`, `Makefile`,
`vcbuild.bat`) is designed to run in a trusted build environment.
The build environment, including environment variables, the file system,
and locally installed tools, is a trusted element in the Node.js threat model.
* Reports about command injection via environment variables in build scripts
(e.g., `CC`, `CXX`, `PKG_CONFIG`, `RUSTC`), path hijacking in build output
directories, or file permissions of build artifacts are **not** considered
vulnerabilities. These scenarios require the attacker to already have control
over the build environment, which means the system is already compromised.
* Build scripts are not a security boundary. They are expected to execute
tools and scripts specified by the environment, and to trust the
file system they operate on.

#### Unhandled 'error' Events on EventEmitters (CWE-248)

* EventEmitters that can emit `'error'` events require the application to
Expand Down
Loading