Low severity · published Jul 10, 2024
CVE-2024-22018
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used
2.9
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.
This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.
This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Node · NodeJS
4.0 before 4.*; 5.0 before 5.*; 6.0 before 6.*; 7.0 before 7.*; 8.0 before 8.*; 9.0 before 9.*; +12 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22018
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22018
www.openwall.com
http://www.openwall.com/lists/oss-security/2024/07/11/6
www.openwall.com
http://www.openwall.com/lists/oss-security/2024/07/19/3
hackerone.com
https://hackerone.com/reports/2145862
security.netapp.com
https://security.netapp.com/advisory/ntap-20240816-0007/
More from Node
10.0
CVE-2026-21636
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled
9.8
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
9.1
CVE-2025-55130
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths
8.4
CVE-2026-58043
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries
8.2
CVE-2026-48617
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation