CVE-2024-22018

2024-07-1003:49:27

redhat.com

access.redhat.com

cve-2024-22018

node.js

experimental permission model

--allow-fs-read

fs.lstat api

file stats

malicious actors

access

node.js 20

node.js 21

experimental feature

CVSS3

2.9

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

3.6

Confidence

High

EPSS

Percentile

16.0%

JSON

A flaw was found in the Node.js package. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files they do not have explicit read access to.