CVE-2024-21890
MEDIUMDescription
The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: ``` --allow-fs-read=/home/node/.ssh/*.pub ``` will ignore `pub` and give access to everything after `.ssh/`. This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Is your site exposed to CVE-2024-21890?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Affected Products
| Vendor | Product |
|---|---|
| nodejs | node.js |
| nodejs | node.js |
References
Other References
Frequently Asked Questions
What is CVE-2024-21890? +
How severe is CVE-2024-21890? +
What products are affected by CVE-2024-21890? +
How do I check if I'm vulnerable to CVE-2024-21890? +
Related Vulnerabilities
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess …
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string …
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If …
Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined …
On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process …
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are …