VulnerabilityDeferred

CVE-2024-36137

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.

LOW 3.3EPSS 0.40%

Does this matter?

Lower severity and a low EPSS score (0.40%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.

CVSS 3.0: 3.3 LOWCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.40% probability · 33th percentile
CISA KEV: Not listed
Source: support@hackerone.com

References

https://nodejs.org/en/blog/vulnerability/july-2024-security-releases
https://security.netapp.com/advisory/ntap-20241122-0005/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.