CVE-2024-21891

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Feb 20, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-218927.8On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with CVE-2024-218938.2A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) CVE-2024-218949.8A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated mal CVE-2024-218969.8The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is CVE-2024-218975.4A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerabili CVE-2024-218988.8An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co CVE-2024-218999.8An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability CVE-2024-219006.5An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow a CVE-2024-219014.7A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrat CVE-2024-219028.1An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. I CVE-2024-219034.7An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co CVE-2024-219046.5A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could all