Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: NodeJS Node 10.*, 11.* and 13 more versions Clear all filters
TI-2023-14407 CVE-2023-30582 · GHSA-cwrj-j635-2m7w

Improper access control in NodeJS Node

Priority LOW 31

A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0058 Published 2024-09-07 Fixed in 20.3.1 CWE-284
TI-2023-14412 CVE-2023-30587 · GHSA-c595-v5xp-gv8w

Improper access control in NodeJS Node

Priority MEDIUM 40

A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00747 Published 2024-09-07 Fixed in 20.3.1 CWE-284
TI-2023-14408 CVE-2023-30583 · GHSA-9ccp-4gjg-264g

Improper access control in NodeJS Node

Priority MEDIUM 40

fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in Node.js 20.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00722 Published 2024-09-07 Fixed in 20.3.1 CWE-284
TI-2023-14409 CVE-2023-30584 · GHSA-jpgc-8hrm-hvwj

Path traversal in NodeJS Node

Priority LOW 36

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model.

CVSS 3.1HIGH 7.7 Local No auth No interaction EPSS 0.00342 Published 2024-09-07 Fixed in 20.3.1 CWE-22