CVE-2021-22921

2021-07-1210:22:24

CWE-732

hackerone

www.cve.org

0.001 Low

EPSS

Percentile

31.6%

JSON

Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.

CNA Affected

[
  {
    "product": "https://github.com/nodejs/node",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in 16.4.1, 14.17.2, and 12.22.2"
      }
    ]
  }
]