CVE-2024-22020

Medium

Description

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.

SeverityMedium

CVSS6.5

Exploit probability—

ProductNode

PublishedJul 9, 2024

First seenJul 9, 2024

Weakness typeCWE-94Code injection

How to fix

Update

NodeJS Node4.*, 5.*, 6.*, 7.*, 8.*, 9.*, 10.*, 11.*, 12.*, 13.*, 14.*, 15.*, 16.*, 17.*, 18.20.4, 19.*, 20.15.1, 21.*, 22.4.1 or later

Affected products

Product	Affected versions	Fixed in
NodeJS Node	4.0 ≤ v < 4., 5.0 ≤ v < 5., 6.0 ≤ v < 6., 7.0 ≤ v < 7., 8.0 ≤ v < 8., 9.0 ≤ v < 9., 10.0 ≤ v < 10., 11.0 ≤ v < 11., 12.0 ≤ v < 12., 13.0 ≤ v < 13., 14.0 ≤ v < 14., 15.0 ≤ v < 15., 16.0 ≤ v < 16., 17.0 ≤ v < 17., 18.0 ≤ v < 18.20.4, 19.0 ≤ v < 19., 20.0 ≤ v < 20.15.1, 21.0 ≤ v < 21., 22.0 ≤ v < 22.4.1	4., 5., 6., 7., 8., 9., 10., 11., 12., 13., 14., 15., 16., 17., 18.20.4, 19., 20.15.1, 21., 22.4.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.