CVE-2017-16024

CVE-2017-16024 describes an information disclosure vulnerability in the sync-exec module, affecting Node.js versions prior to 0.11.9 and projects utilizing sync-exec. The module's use of temporary directories as a buffer for child_process.execSync simulations allows other server users with read access to potentially obtain confidential information from these temporary files. With a CVSS score of 6.5 (Medium), this vulnerability has a network attack vector and low attack complexity, leading to high confidentiality impact. There is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.