Vulnerability · Published Feb 20, 2024 · Assigned by hackerone
CVE-2024-21891
High 7.9
In plain English
A high-severity path traversal in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 | ALSA-2024:1687 |
| AlmaLinux:9 | nodejs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 | ALSA-2024:1688 |
| AlmaLinux:8 | nodejs-devel | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 | ALSA-2024:1687 |
| AlmaLinux:9 | nodejs-devel | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 | ALSA-2024:1688 |
| AlmaLinux:8 | nodejs-docs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 | ALSA-2024:1687 |
| AlmaLinux:9 | nodejs-docs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 | ALSA-2024:1688 |
| AlmaLinux:8 | nodejs-full-i18n | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 | ALSA-2024:1687 |
| AlmaLinux:9 | nodejs-full-i18n | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 | ALSA-2024:1688 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 | ALSA-2024:1687 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 | ALSA-2024:1688 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2024:1687 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-4.module_el9.3.0+48+1cf146a1 | ALSA-2024:1688 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2024:1687 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+48+1cf146a1 | ALSA-2024:1688 |
| AlmaLinux:8 | npm | 1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35 | ALSA-2024:1687 |
| AlmaLinux:9 | npm | 1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2 | ALSA-2024:1688 |
| Rocky Linux:8 | nodejs | 1:20.11.1-1.module+el8.9.0+1776+addd4aec | RLSA-2024:1687 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:1687 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 | RLSA-2024:1688 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:1687 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:1688 |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N