THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Fathom (Privacy friendly web analytics)
Zendesk (Helpdesk and Chat)

Ok

Home | EN
Support
CVE
PUBLISHED

CVE-2024-22020

Assignerhackerone
Reserved2024-01-04
Published2024-07-09
Updated2024-07-13

Description

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.



MEDIUM: 6.5CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H

Product status

Default status
unaffected

21.6.1
affected

20.11.0
affected

18.19.0
affected

References

https://hackerone.com/reports/2092749

http://www.openwall.com/lists/oss-security/2024/07/11/6

cve.org CVE-2024-22020

nvd.nist.gov CVE-2024-22020

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-22020
© Copyright 2024 THREATINT. Made in Cyprus with +