Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-b7hq-5yyx-tuhs
Vulnerability ID VCID-b7hq-5yyx-tuhs
Aliases CVE-2021-22921
Summary Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.00527 https://api.first.org/data/v1/epss?cve=CVE-2021-22921
epss 0.00527 https://api.first.org/data/v1/epss?cve=CVE-2021-22921
epss 0.00527 https://api.first.org/data/v1/epss?cve=CVE-2021-22921
epss 0.00527 https://api.first.org/data/v1/epss?cve=CVE-2021-22921
epss 0.00527 https://api.first.org/data/v1/epss?cve=CVE-2021-22921
epss 0.00527 https://api.first.org/data/v1/epss?cve=CVE-2021-22921
epss 0.00527 https://api.first.org/data/v1/epss?cve=CVE-2021-22921
epss 0.00527 https://api.first.org/data/v1/epss?cve=CVE-2021-22921
epss 0.00527 https://api.first.org/data/v1/epss?cve=CVE-2021-22921
archlinux Medium https://security.archlinux.org/AVG-2130
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-22921
AVG-2130 https://security.archlinux.org/AVG-2130
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.67048
EPSS Score 0.00527
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T18:08:16.684684+00:00 EPSS Importer Import https://epss.cyentia.com/epss_scores-current.csv.gz 38.0.0