CVE-2024-21891 is a high-severity path traversal vulnerability affecting Node.js versions 20 and 21 when utilizing the experimental permission model. This flaw allows attackers to bypass filesystem permissions by overwriting built-in path normalization functions with custom implementations. With a CVSS score of 8.8, it presents a significant risk of complete compromise (confidentiality, integrity, and availability) via a low-complexity network attack requiring low privileges. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 20.0, < 20.11.1CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 21.0, < 21.6.2CPE match | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 20.0.0, < 20.11.1CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* | ||
>= 21.0.0, < 21.6.2CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization
Feb 19, 2024Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued the permission model is an experimental feature of Node.js.
Feb 13, 2024