CVE-2014-3744
High · 7.5CVSS
7.5
EPSS
34.0%
Published
Oct 23, 2017
CISA due date
—
The record
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | st | 0 | 0.2.5 |
| Ubuntu:Pro:14.04:LTS | nodejs | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | nodejs | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | nodejs | 0 | No fix |
Related vulnerabilities
- CVE-2025-23085 A memory leak could occur when a remote peer abruptly closes the socket without sending a… Also affects nodejs
- CVE-2025-23084 A vulnerability has been identified in Node.js, specifically affecting the handling of… Also affects nodejs
- CVE-2025-23083 With the aid of the diagnostics_channel utility, an event can be hooked into whenever a… Also affects nodejs
- CVE-2024-37372 The Permission Model assumes that any path starting with two backslashes \ has a… Also affects nodejs
- CVE-2023-39333 Maliciously crafted export names in an imported WebAssembly module can inject JavaScript… Also affects nodejs
- CVE-2023-46809 Node.js versions which bundle an unpatched version of OpenSSL or run against a… Also affects nodejs
- CVE-2024-36137 A vulnerability has been identified in Node.js, affecting users of the experimental… Also affects nodejs
- CVE-2024-36138 Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch… Also affects nodejs