CVE-2024-21891

Name of the Vulnerable Software and Affected Versions: Node.js versions 20 through 21

Description: The issue is related to the experimental permission model in Node.js, where user-defined implementations can overwrite built-in utility functions used to normalize paths provided to node:fs functions. This can lead to a filesystem permission model bypass through a path traversal attack. The vulnerability affects users of the experimental permission model in the specified Node.js versions.

Recommendations: For Node.js versions 20 through 21, consider disabling the experimental permission model until a patch is available. Restrict access to node:fs functions to minimize the risk of exploitation. Avoid using user-defined implementations for path normalization until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.