CVSS: 8.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-27980
https://notcve.org/view.php?id=CVE-2024-27980
09 Jan 2025 — Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled. • http://www.openwall.com/lists/oss-security/2024/04/10/15 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 2.9EPSS: 0%CPEs: 2EXPL: 0CVE-2024-22018 – nodejs: fs.lstat bypasses permission model
https://notcve.org/view.php?id=CVE-2024-22018
10 Jul 2024 — A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was iss... • http://www.openwall.com/lists/oss-security/2024/07/11/6 •
CVSS: 7.6EPSS: 0%CPEs: 3EXPL: 0CVE-2024-22020 – nodejs: Bypass network import restriction via data URL
https://notcve.org/view.php?id=CVE-2024-22020
09 Jul 2024 — A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers. Un fallo de seguridad en Node.js permite eludir las restricciones de importación de la red. Al incorporar importaci... • http://www.openwall.com/lists/oss-security/2024/07/11/6 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2024-3566 – Command injection vulnerability in programing languages on Microsoft Windows operating system.
https://notcve.org/view.php?id=CVE-2024-3566
10 Apr 2024 — A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied. • https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-22025 – nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service
https://notcve.org/view.php?id=CVE-2024-22025
19 Mar 2024 — A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory, potent... • https://hackerone.com/reports/2284065 • CWE-400: Uncontrolled Resource Consumption CWE-404: Improper Resource Shutdown or Release •
CVSS: 7.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21896 – nodejs: path traversal by monkey-patching buffer internals
https://notcve.org/view.php?id=CVE-2024-21896
20 Feb 2024 — The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission mode... • http://www.openwall.com/lists/oss-security/2024/03/11/1 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-27: Path Traversal: 'dir/../../filename' •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22019 – nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks
https://notcve.org/view.php?id=CVE-2024-22019
20 Feb 2024 — A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits. Una vulnerabilidad en los servidores HTTP de Node.js permite a un atacan... • http://www.openwall.com/lists/oss-security/2024/03/11/1 • CWE-400: Uncontrolled Resource Consumption CWE-404: Improper Resource Shutdown or Release •