Search for vulnerabilities
Vulnerability details: VCID-dfxn-8qeq-yuek
Vulnerability ID VCID-dfxn-8qeq-yuek
Aliases CVE-2024-22020
Summary A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.
Status Published
Exploitability 0.5
Weighted Severity 5.9
Risk 3.0
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22020.json
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00107 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00114 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00114 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00114 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00114 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00114 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00114 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
epss 0.00114 https://api.first.org/data/v1/epss?cve=CVE-2024-22020
cvssv3.1 6.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 6.5 https://hackerone.com/reports/2092749
ssvc Track https://hackerone.com/reports/2092749
cvssv3 6.5 http://www.openwall.com/lists/oss-security/2024/07/11/6
ssvc Track http://www.openwall.com/lists/oss-security/2024/07/11/6
cvssv3 6.5 http://www.openwall.com/lists/oss-security/2024/07/19/3
ssvc Track http://www.openwall.com/lists/oss-security/2024/07/19/3
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22020.json
https://api.first.org/data/v1/epss?cve=CVE-2024-22020
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://security.netapp.com/advisory/ntap-20241122-0006/
2092749 https://hackerone.com/reports/2092749
2296417 https://bugzilla.redhat.com/show_bug.cgi?id=2296417
3 http://www.openwall.com/lists/oss-security/2024/07/19/3
6 http://www.openwall.com/lists/oss-security/2024/07/11/6
CVE-2024-22020 https://nvd.nist.gov/vuln/detail/CVE-2024-22020
RHSA-2024:5814 https://access.redhat.com/errata/RHSA-2024:5814
RHSA-2024:5815 https://access.redhat.com/errata/RHSA-2024:5815
RHSA-2024:6147 https://access.redhat.com/errata/RHSA-2024:6147
RHSA-2024:6148 https://access.redhat.com/errata/RHSA-2024:6148
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22020.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H Found at https://hackerone.com/reports/2092749
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-13T03:55:30Z/ Found at https://hackerone.com/reports/2092749
Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2024/07/11/6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-13T03:55:30Z/ Found at http://www.openwall.com/lists/oss-security/2024/07/11/6
Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2024/07/19/3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-13T03:55:30Z/ Found at http://www.openwall.com/lists/oss-security/2024/07/19/3
Exploit Prediction Scoring System (EPSS)
Percentile 0.15957
EPSS Score 0.00052
Published At Aug. 1, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:31:29.060507+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.22/main.json 37.0.0