CVE-2021-22921CWE-732

Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms

published July 12, 2021

CVSS
—
EPSS
7%
Percentile
94.4
In the wild
Unconfirmed
What it is

Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07409 · 94.4th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2021-07-12T10:22Z
EPSS history
Timeline
  • 12 JUL 10:22Z
    Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms
    cvelistv5