CVE-2021-21131: 
Node.js vulnerability analysis and mitigation

Insufficient policy enforcement in File System API in Google Chrome prior to version 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions through a crafted HTML page. The vulnerability was discovered and reported by Maciej Pulikowski on October 20, 2020, and was assigned CVE-2021-21131 (Chrome Blog, NVD).

The vulnerability was classified with a CVSS v3.1 base score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. This indicates that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction. The vulnerability is associated with CWE-59 (Improper Link Resolution Before File Access) and CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD).

The vulnerability could allow attackers to bypass filesystem restrictions, potentially leading to unauthorized access to local files or directories. The impact is primarily focused on integrity, with no direct effect on confidentiality or availability (NVD).

The vulnerability was patched in Google Chrome version 88.0.4324.96 and Microsoft Edge (Chromium-based) version 88.0.705.50. Users are advised to update their browsers to these versions or later to mitigate the risk (Chrome Blog).