RCE in Nodejs Node
CVE-2024-22020
A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.011 (62.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H.
Affected products
- Nodejs Node — versions 4.0, 5.0, 6.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2024-22020?
- CVE-2024-22020 is a medium-severity vulnerability in Nodejs Node, classified under Code Injection. CVSS score: 6.5/10. Published 2024-07-09.
- How severe is CVE-2024-22020?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2024-22020 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.