What is CVE-2024-22020?

CVE-2024-22020 is a medium-severity vulnerability in Nodejs Node. CVSS score: 6.5/10. Published 2024-07-09.

How severe is CVE-2024-22020?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2024-22020 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Nodejs Node

CVE-2024-22020

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerabili…

EPSS: 0.001 (32.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H.

Affected products

Nodejs Node — versions 4.0, 5.0, 6.0

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds
sharmapintu987654321-boop/Nessus-Scan-Reports
w4zu/Debian_

References

hackerone.com/reports/2092749
www.openwall.com/lists/oss-security/2024/07/11/6
www.openwall.com/lists/oss-security/2024/07/19/3

Frequently asked questions

What is CVE-2024-22020?: CVE-2024-22020 is a medium-severity vulnerability in Nodejs Node. CVSS score: 6.5/10. Published 2024-07-09.
How severe is CVE-2024-22020?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2024-22020 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.