High severity · published Jul 12, 2021
CVE-2021-22921
Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms
7.8
CVSS
7.4%
EPSS
No
On KEV
Description
Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Node.js · Nodejs
12.0.0 before 12.22.2; 14.0.0 before 14.17.2; 16.0.0 before 16.4.1 · source: NVD
SI
Sinec Infrastructure Network Services · Siemens
before 1.0.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22921
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22921
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Exploit
https://hackerone.com/reports/1211160
Patch
https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210805-0003/
More from Node.js
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2026-21636
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled
9.8
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
9.8
CVE-2024-3566
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific…
9.8
CVE-2024-21896
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user