OESA-2025-1199 (CVE-2024-22018)
Vulnerability from osv_openeuler – Published: 2025-02-28 11:08 – Updated: 2026-08-06 11:08 – Source websiteNode.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.
Security Fix(es):
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.(CVE-2024-22018)
A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.(CVE-2024-22020)
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"aarch64": [
"nodejs-20.18.2-1.oe2403.aarch64.rpm",
"nodejs-debuginfo-20.18.2-1.oe2403.aarch64.rpm",
"nodejs-debugsource-20.18.2-1.oe2403.aarch64.rpm",
"nodejs-devel-20.18.2-1.oe2403.aarch64.rpm",
"nodejs-full-i18n-20.18.2-1.oe2403.aarch64.rpm",
"nodejs-libs-20.18.2-1.oe2403.aarch64.rpm",
"npm-10.8.2-1.20.18.2.1.oe2403.aarch64.rpm",
"v8-devel-11.3.244.8-1.20.18.2.1.oe2403.aarch64.rpm"
],
"noarch": [
"nodejs-docs-20.18.2-1.oe2403.noarch.rpm"
],
"src": [
"nodejs-20.18.2-1.oe2403.src.rpm"
],
"x86_64": [
"nodejs-20.18.2-1.oe2403.x86_64.rpm",
"nodejs-debuginfo-20.18.2-1.oe2403.x86_64.rpm",
"nodejs-debugsource-20.18.2-1.oe2403.x86_64.rpm",
"nodejs-devel-20.18.2-1.oe2403.x86_64.rpm",
"nodejs-full-i18n-20.18.2-1.oe2403.x86_64.rpm",
"nodejs-libs-20.18.2-1.oe2403.x86_64.rpm",
"npm-10.8.2-1.20.18.2.1.oe2403.x86_64.rpm",
"v8-devel-11.3.244.8-1.20.18.2.1.oe2403.x86_64.rpm"
]
},
"package": {
"ecosystem": "openEuler:24.03-LTS",
"name": "nodejs",
"purl": "pkg:rpm/openEuler/nodejs\u0026distro=openEuler-24.03-LTS"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "20.18.2-1.oe2403"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"severity": "Medium"
},
"details": "Node.js is a platform built on Chrome\u0026amp;apos;s JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.\r\n\r\nSecurity Fix(es):\n\nA vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.(CVE-2024-22018)\n\nA security flaw in Node.js allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.(CVE-2024-22020)",
"id": "OESA-2025-1199",
"modified": "2026-08-06T11:08:17Z",
"published": "2025-02-28T11:08:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1199"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22018"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22020"
}
],
"schema_version": "1.7.2",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "nodejs security update",
"upstream": [
"CVE-2024-22018",
"CVE-2024-22020"
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.