CVEvulnerability

CVE-2024-22017

7.3 HIGH Published 2024-03-19 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2024-03-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.3 HIGH — CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L
Weaknesses
CWE-250

Description

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

Related

Weakness · CWE (1)

  • CWE-250 Execution with Unnecessary Privileges weakness

References