A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
CVSS Details
- CVSS 3.0 Base Score: 3.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-full-i18n | Aug 28, 2024 | Aug 26, 2024 |
| Alpine Linux | — | Upgrade nodejs | Oct 1, 2024 | Sep 7, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs20-npmUpgrade nodejs20-debuginfoUpgrade nodejs20-libs-debuginfoUpgrade nodejs20-develUpgrade v8-11.3-develUpgrade nodejs20Upgrade nodejs20-libsUpgrade nodejs20-docsUpgrade nodejs20-debugsourceUpgrade nodejs20-full-i18n | Feb 17, 2025 | Jul 8, 2024 |
| Debian | — | Upgrade nodejs | Jul 27, 2026 | Jul 27, 2026 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 15, 2025 | Sep 7, 2024 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-nodemon | Oct 16, 2024 | Jul 8, 2024 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-full-i18n | Sep 13, 2024 | Sep 7, 2024 |
| Rocky_linux | — | Upgrade nodejsUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-devel | Sep 17, 2024 | Sep 7, 2024 |
| Suse | — | Upgrade nodejs22-docsUpgrade npm22Upgrade nodejs22Upgrade nodejs20-docsUpgrade corepack20Upgrade corepack22Upgrade npm20Upgrade nodejs20Upgrade nodejs20-develUpgrade nodejs22-devel | Jul 18, 2024 | Jul 17, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 7, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub