CVE-2022-21190

CVE-2022-21190 is a critical vulnerability affecting the 'convict' package before version 6.2.3, specifically a bypass of a previous fix for CVE-2022-22143. This flaw allows attackers to prepend dangerous paths with arbitrary strings, bypassing existing security checks. With a CVSS score of 9.8 (Critical), it presents a high risk due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered significant community discussion, indicating awareness and potential future exploitation.