Privilege Escalation Vulnerability in Node.js by Joyent

CVE-2024-22017

What is CVE-2024-22017?

A vulnerability exists in Node.js affecting versions 18.18.0 and higher where the internal io_uring operations of libuv are not correctly influenced by the setuid() call. This flaw permits processes to execute privileged operations even after the intended privilege drop has occurred, representing a significant risk to applications leveraging Node.js for secure operations. Developers and system administrators are advised to review their versions of Node.js and apply necessary patches or mitigations to safeguard against unauthorized access and potential exploitation.

References