CVE-2024-22018 — nodejs: fs.lstat bypasses permission model

Back Back to CVE browser

LOW

nodejs: fs.lstat bypasses permission model

Published Jul 10, 2024

2.9

LOW

CVSS 3.0

EPSS 0.46%

Description

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Affected products

Vendor Node.js Product Node Default
unaffected
- Version
  10.0
  Status
  affected
  Constraints
  <10.*
- Version
  11.0
  Status
  affected
  Constraints
  <11.*
- Version
  12.0
  Status
  affected
  Constraints
  <12.*
- Version
  13.0
  Status
  affected
  Constraints
  <13.*
- Version
  14.0
  Status
  affected
  Constraints
  <14.*
- Version
  15.0
  Status
  affected
  Constraints
  <15.*
- Version
  16.0
  Status
  affected
  Constraints
  <16.*
- Version
  17.0
  Status
  affected
  Constraints
  <17.*
- Version
  19.0
  Status
  affected
  Constraints
  <19.*
- Version
  20.0
  Status
  affected
  Constraints
  <20.15.1
- Version
  21.0
  Status
  affected
  Constraints
  <21.*
- Version
  22.0
  Status
  affected
  Constraints
  <22.4.1
- Version
  4.0
  Status
  affected
  Constraints
  <4.*
- Version
  5.0
  Status
  affected
  Constraints
  <5.*
- Version
  6.0
  Status
  affected
  Constraints
  <6.*
- Version
  7.0
  Status
  affected
  Constraints
  <7.*
- Version
  8.0
  Status
  affected
  Constraints
  <8.*
- Version
  9.0
  Status
  affected
  Constraints
  <9.*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Node.js

Node

unaffected

Version	Status	Constraints
10.0	affected	<10.*
11.0	affected	<11.*
12.0	affected	<12.*
13.0	affected	<13.*
14.0	affected	<14.*
15.0	affected	<15.*
16.0	affected	<16.*
17.0	affected	<17.*
19.0	affected	<19.*
20.0	affected	<20.15.1
21.0	affected	<21.*
22.0	affected	<22.4.1
4.0	affected	<4.*
5.0	affected	<5.*
6.0	affected	<6.*
7.0	affected	<7.*
8.0	affected	<8.*
9.0	affected	<9.*

Red Hat Enterprise Linux 8

nodejs:20-8100020240808073736.489197e6

Fixed · RHSA-2024:5814
Red Hat Enterprise Linux 9

nodejs:20-9040020240807145403.rhel9

Fixed · RHSA-2024:5815
Red Hat Enterprise Linux 10

nodejs20

Fix deferred
Red Hat Enterprise Linux 8

nodejs:18/nodejs

Not affected
Red Hat Enterprise Linux 9

nodejs:18/nodejs-packaging

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	nodejs:20-8100020240808073736.489197e6	Fixed	RHSA-2024:5814
Red Hat Enterprise Linux 9	nodejs:20-9040020240807145403.rhel9	Fixed	RHSA-2024:5815
Red Hat Enterprise Linux 10	nodejs20	Fix deferred	n/a
Red Hat Enterprise Linux 8	nodejs:18/nodejs	Not affected	n/a
Red Hat Enterprise Linux 9	nodejs:18/nodejs-packaging	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

0.46% 0.00458

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00458

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (5 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.46% (0.00458)	37.39th	v5 (v2026.06.15)
Jun 15, 2026	0.46% (0.00458)	36.08th	v5 (v2026.06.15)
Mar 17, 2025	0.05% (0.00053)	13.50th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00045)	17.70th	v3 (v2023.03.01)
Jul 10, 2024	0.04% (0.00043)	9.24th	v3 (v2023.03.01)

Weaknesses (0)

No CWE recorded.

References (8)

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2024/07/11/6
http://www.openwall.com/lists/oss-security/2024/07/19/3
https://access.redhat.com/security/cve/CVE-2024-22018		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2296990		Issue Tracking
https://hackerone.com/reports/2145862
https://nvd.nist.gov/vuln/detail/CVE-2024-22018
https://security.netapp.com/advisory/ntap-20240816-0007/
https://www.cve.org/CVERecord?id=CVE-2024-22018