description: A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
affected:
{
vendor: Node.js
product: Node.js
versions:
version: 20.8.0, status: affected, lessThanOrEqual: 20.8.0, versionType: semver
version: 20.0.0, status: unaffected, lessThan: 20.0.0, versionType: semver
}
metrics:
cvssV3_0: [
version: 3.0
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
baseScore: 7.7
baseSeverity: HIGH
]