We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-22020



Assignerhackerone
Reserved2024-01-04
Published2024-07-09
Updated2024-10-25

Description

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.



MEDIUM: 6.5CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H

Product status

Default status
unaffected

21.6.1
affected

20.11.0
affected

18.19.0
affected

References

https://hackerone.com/reports/2092749

http://www.openwall.com/lists/oss-security/2024/07/11/6

http://www.openwall.com/lists/oss-security/2024/07/19/3

cve.org CVE-2024-22020

nvd.nist.gov CVE-2024-22020

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-22020
Subscribe to our newsletter to learn more about our work.