Medium severity · published Jul 9, 2024
CVE-2024-22020
A security flaw in Node.js allows a bypass of network import restrictions
6.5
CVSS
1.1%
EPSS
No
On KEV
Description
A security flaw in Node.js allows a bypass of network import restrictions.
By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.
Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.
Exploiting this flaw can violate network import security, posing a risk to developers and servers.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Node · NodeJS
4.0 before 4.*; 5.0 before 5.*; 6.0 before 6.*; 7.0 before 7.*; 8.0 before 8.*; 9.0 before 9.*; +13 more · source: vendor
NO
Nodejs · Nodejs
21.6.1; 20.11.0; 18.19.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22020
www.openwall.com
http://www.openwall.com/lists/oss-security/2024/07/11/6
www.openwall.com
http://www.openwall.com/lists/oss-security/2024/07/19/3
hackerone.com
https://hackerone.com/reports/2092749
security.netapp.com
https://security.netapp.com/advisory/ntap-20241122-0006/
More from Node
10.0
CVE-2026-21636
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled
9.8
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
9.1
CVE-2025-55130
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths
8.4
CVE-2026-58043
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries
8.2
CVE-2026-48617
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation