|
Vulnerabilities
< Back

CVE-2024-22020

Updated on 09 Jul 2024

Severity

6.5 Medium severity

Details

CVSS score
6.5
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.

Details

Affected product:
AlmaLinux 9.2 ESU , Alpine Linux 3.22 , Debian 10 , Debian 11 , Debian 12 , Debian 13 , EL 10 , EL 7 , EL 8 , EL 9 , TuxCare 9.6 ESU , Ubuntu 18.04 , Ubuntu 20.04 , Ubuntu 22.04 , Ubuntu 24.04
Affected packages:
nodejs @ 12 (+68 more)
A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.

Fixes