PT-2026-122239

Name of the Vulnerable Software and Affected Versions happy-dom versions 17.0.0 through 21.0.3 Description The ESM compiler in packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts fails to validate named ESM import aliases before inserting them into generated destructuring bindings. When...

Improper Privilege Management

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Privilege Management in the require process. An attacker can gain unauthorized access to restricted filesystem operations by bypassing the...

EUVD-2023-43063

Malicious code in bioql PyPI...

BIT-NODE-2023-39332

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings see CVE-2023-30584 and Buffer objects see CVE-2023-32004, but not through non-Buffer...

CVE-2024-21891: Improper Limitation of a Pathname to a Restricted Directory

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experiment...

PT-2024-3905

Name of the Vulnerable Software and Affected Versions: Node.js versions 20 through 21 Description: The issue is related to the experimental permission model in Node.js, where user-defined implementations can overwrite built-in utility functions used to normalize paths provided to node:fs function...

CVE-2023-39332

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings see CVE-2023-30584 and Buffer objects see CVE-2023-32004, but not through non-Buffer...

CVE-2023-39332

Various "node:fs" functions allow specifying paths as either strings or "Uint8Array" objects. In Node.js environments, the "Buffer" class extends the "Uint8Array" class. Node.js prevents path traversal through strings see CVE-2023-30584 and "Buffer" objects see CVE-2023-32004, but not through...

CVE-2023-39332

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings see CVE-2023-30584 and Buffer objects see CVE-2023-32004, but not through non-Buffer...

CVE-2023-39332

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings see CVE-2023-30584 and Buffer objects see CVE-2023-32004, but not through non-Buffer...

CVE-2023-39332: Improper Limitation of a Pathname to a Restricted Directory

Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings see CVE-2023-30584 and Buffer objects see CVE-2023-32004, but not through non-Buffer...

PT-2023-6420

Name of the Vulnerable Software and Affected Versions Node.js affected versions not specified Description The issue is related to incorrect restriction of directory path names with limited access. Exploitation of this issue may allow an attacker to access confidential information. The problem...