CVEvulnerability
CVE-2024-22020
6.5 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2024-07-09
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.5 MEDIUM — CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H
- Weaknesses
- CWE-94
Description
A security flaw in Node.js allows a bypass of network import restrictions.
By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.
Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.
Exploiting this flaw can violate network import security, posing a risk to developers and servers.
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://www.openwall.com/lists/oss-security/2024/07/11/6 www.openwall.com
- http://www.openwall.com/lists/oss-security/2024/07/19/3 www.openwall.com
- https://hackerone.com/reports/2092749 hackerone.com
- http://www.openwall.com/lists/oss-security/2024/07/11/6 www.openwall.com
- http://www.openwall.com/lists/oss-security/2024/07/19/3 www.openwall.com
- https://hackerone.com/reports/2092749 hackerone.com
- https://security.netapp.com/advisory/ntap-20241122-0006/ security.netapp.com