CVE-2024-21890

Summary

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example:

 --allow-fs-read=/home/node/.ssh/*.pub

will ignore pub and give access to everything after .ssh/.

This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Affected Software

VendorProductVersion RangeStatus
NodeJSNode4.0 < 4.*affected
NodeJSNode5.0 < 5.*affected
NodeJSNode6.0 < 6.*affected
NodeJSNode7.0 < 7.*affected
NodeJSNode8.0 < 8.*affected
NodeJSNode9.0 < 9.*affected
NodeJSNode10.0 < 10.*affected
NodeJSNode11.0 < 11.*affected
NodeJSNode12.0 < 12.*affected
NodeJSNode13.0 < 13.*affected
NodeJSNode14.0 < 14.*affected
NodeJSNode15.0 < 15.*affected
NodeJSNode16.0 < 16.*affected
NodeJSNode17.0 < 17.*affected
NodeJSNode19.0 < 19.*affected
NodeJSNode20.0 < 20.11.1affected
NodeJSNode21.0 < 21.6.2affected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References