CVE-2024-22020: Code Injection
A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.
Other sources
Node.js could allow a remote attacker to execute arbitrary code on the system. By embedding non-network imports in data URLs, an attacker could exploit this vulnerability to bypass network import restrictions and execute arbitrary code on the system.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22020?
CVE-2024-22020 is considered a high-severity vulnerability due to its potential to allow attackers to execute arbitrary code.
How do I fix CVE-2024-22020?
To fix CVE-2024-22020, ensure data URLs are forbidden in network imports in affected software versions.
Which versions of IBM Planning Analytics are affected by CVE-2024-22020?
CVE-2024-22020 affects IBM Planning Analytics versions up to and including 2.1 and 2.0.
Can CVE-2024-22020 be exploited on all platforms?
Yes, CVE-2024-22020 has been verified to be exploitable on various platforms.
What is the main impact of CVE-2024-22020?
The main impact of CVE-2024-22020 is the compromise of system security through the execution of arbitrary code.