PT-2024-6045 · Node.Js+7 · Node.Js+7

Dittyroma · Published 2024-07-08 · Updated 2026-05-18 · CVE-2024-22020

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 18.20.4 Node.js versions prior to 20.15.1 Node.js versions prior to 22.4.1

Description A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. The vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.

Recommendations Update to Node.js version 18.20.4 or newer. Update to Node.js version 20.15.1 or newer. Update to Node.js version 22.4.1 or newer. As a temporary workaround, consider forbidding data URLs in network imports until a patch is available.

Fix

Improper Access Control

Code Injection

Weakness Enumeration

CWE-284

CWE-94

Related Identifiers

ALSA-2024:5814

ALSA-2024:5815

ALSA-2024:6147

ALSA-2024:6148

AZL-43195

AZL-43216

BDU:2024-06867

BIT-NODE-2024-22020

BIT-NODE-MIN-2024-22020

CESA-2024_5814

CESA-2024_6148

CLEANSTART-2026-BD71263

CLEANSTART-2026-IS74202

CLEANSTART-2026-JR35772

CLEANSTART-2026-JY06700

CLEANSTART-2026-KN34553

CLEANSTART-2026-KZ45320

CLEANSTART-2026-LJ44720

CLEANSTART-2026-LN12820

CLEANSTART-2026-TX00223

CLEANSTART-2026-WI75198

CVE-2024-22020

DSA-5991-1

ECHO-B543-B469-0D25

INFSA-2024_5814

INFSA-2024_5815

INFSA-2024_6147

INFSA-2024_6148

MGASA-2024-0282

OESA-2025-1199

OESA-2025-1200

OPENSUSE-SU-2024:14214-1

OPENSUSE-SU-2024:14435-1

OPENSUSE-SU-2024_2542-1

OPENSUSE-SU-2025:15802-1

RHSA-2024:5814

RHSA-2024:5815

RHSA-2024:6147

RHSA-2024:6148

RHSA-2024_5814

RHSA-2024_5815

RHSA-2024_6147

RHSA-2024_6148

RLSA-2024:5814

RLSA-2024:5815

RLSA-2024:6147

RLSA-2024:6148

SUSE-SU-2024:2496-1

SUSE-SU-2024:2542-1

SUSE-SU-2024:2543-1

SUSE-SU-2024:2574-1

SUSE-SU-2024_2496-1

SUSE-SU-2024_2542-1

Affected Products

Almalinux

Centos

Debian

Node.Js

Red Hat

Red Os

Rocky Linux

Suse

References · 264

• https://osv.dev/vulnerability/ALSA-2024:6148 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-6147.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22931 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-24807 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9514 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-37372 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-23918 · Security Note
• https://osv.dev/vulnerability/DSA-5991-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2024:6147 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2024:5814 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-22020 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000168 · Security Note
• https://errata.rockylinux.org/RLSA-2024:5815 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-22020 · Vendor Advisory