CVE-2024-22020

Low

Low Medium High Critical

CVSS Score

Published: Jul 09, 2024

Last Modified: Mar 14, 2025

Vulnerability Description

A security flaw in Node.js allows a bypass of network import restrictions.
By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.
Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.
Exploiting this flaw can violate network import security, posing a risk to developers and servers.

Available Security Patches

2 patches available from vendors

View All Patches

Microsoft

2025-Feb-CVE-2024-22020

CVE-2024-22020: None

Severity

Unknown

Released

Oct 24, 2025

Security Update

View Details Vendor Page

Oracle

CPUJAN2025

Oracle Critical Patch Update Advisory - January 2025

Severity

Critical

Released

Jan 21, 2025

Restart Required

Security Update

View Details Vendor Page

Browse All Security Patches

References & Resources

Severity Details

out of 10.0

Low

Weakness Type (CWE)

CWE-94 Top 25 #7

Improper Control of Generation of Code ('Code Injection')

Description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Exploit Likelihood: Medium
Typical Severity: High
OWASP Top 10: A03:2021-Injection
Abstraction Level: Base