CVE-2024-22020

A security flaw in Node.js allows a bypass of network import restrictions

Medium · published July 9, 2024

CVSS v3.0
6.5
EPSS
1%
Percentile
65.5
In the wild
Unconfirmed
What it is

A security flaw in Node.js allows a bypass of network import restrictions.

By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.

Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.

Exploiting this flaw can violate network import security, posing a risk to developers and servers.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01104 · 65.5th percentile
Published
2024-07-09T01:07Z
EPSS history
Timeline
  • 09 JUL 01:07Z
    A security flaw in Node.js allows a bypass of network import restrictions
    cvelistv5