CVE-2021-22921

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published
Jul 12, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-229226.5When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML CVE-2021-229235.3When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, CVE-2021-229243.7libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errCVE-2021-229255.3curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=conCVE-2021-229267.5libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` optioCVE-2021-229278.1A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow aCVE-2021-229287.8A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has eitCVE-2021-229296.1An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps oCVE-2021-22934.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.CVE-2021-229309.8Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory cCVE-2021-229319.8Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validationCVE-2021-229327.5An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which causes the ShareFile file
CVE-2021-22921: High severity, CVSS 7.8 | Vulnix