CVE-2024-22020

Description

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.

How to fix CVE-2024-22020

To remediate CVE-2024-22020, upgrade the affected package to a fixed version below.

—upgrade to 20.15.1-r0 or later
—upgrade to 18.20.4 or later
—upgrade to 18.20.5 or later
—upgrade to 18.20.4+dfsg-1~deb12u1 or later

Is CVE-2024-22020 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

from 0, < 20.15.1-r0
from 0, < 18.20.4, >= 19.0.0, < 20.15.1, >= 21.0.0, < 22.4.1
from 0, < 18.20.5, >= 19.0.0, < 20.18.1, >= 21.0.0, < 22.12.0
from 0, < 18.20.4+dfsg-1~deb12u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H