7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
22.2%
A previously disclosed vulnerability (CVE-2023-30584) was patched
insufficiently in commit 205f1e6. The new path traversal vulnerability
arises because the implementation does not protect itself against the
application overwriting built-in utility functions with user-defined
implementations. Please note that at the time this CVE was issued, the
permission model is an experimental feature of Node.js.