CVE-2024-22018

Name of the Vulnerable Software and Affected Versions: Node.js versions 20 through 21

Description: A flaw in the experimental permission model of Node.js allows malicious actors to retrieve stats from files they do not have explicit read access to when the --allow-fs-read flag is used. This issue arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API.

Recommendations: For Node.js versions 20 and 21, consider disabling the experimental permission model until a patch is available. Restrict access to the fs.lstat API to minimize the risk of exploitation. Avoid using the --allow-fs-read flag in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.