CVE-2024-21891

What it actually does

The vulnerability permits user code to replace Node.js built-in path normalization utilities used by fs functions, allowing crafted inputs to bypass the experimental permission model's directory restrictions via path traversal sequences.

Why it matters to the business

Applications relying on the experimental permission model may expose files outside explicitly allowed paths, increasing risk of unauthorized data access or modification in Node.js environments.

How an attack unfolds

An attacker supplies input or a module that overwrites the internal path normalization functions, then issues file system operations containing traversal payloads such as '../' sequences to escape the sandboxed directories enforced by the permission model.

How to fix it

Upgrade Node.js to a build containing commit 3eccdd1ae61777a381a7ac3bc0ea62443dbb50b8 or later; avoid enabling the experimental permission model in production until the fix is applied.

How to confirm the fix worked

Confirm the installed Node.js binary or source contains commit 3eccdd1ae61777a381a7ac3bc0ea62443dbb50b8; re-test the permission model with traversal payloads to verify restrictions are enforced.

Typical attack path

1. Locate a Node.js process running version 20 or 21 with the experimental permission model enabled
2. Inject or load attacker-controlled code that replaces the built-in path normalization utilities
3. Trigger a file system operation (read, write, etc.) using a path containing traversal sequences
4. Bypass permission checks and access files outside the declared allow list

How to detect it

Monitor Node.js application logs and process behavior for unexpected file accesses outside declared permission directories; inspect for dynamic overrides of internal path utilities in loaded modules.

What your security team should do

• Disable the experimental permission model unless strictly required
• Apply the fix commit 3eccdd1ae61777a381a7ac3bc0ea62443dbb50b8 across all Node.js 20/21 deployments
• Review application code for any reliance on the permission model and plan migration to stable alternatives once available