CVE-2024-36137
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 22.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36137?
CVE-2024-36137 has been classified as a high severity vulnerability affecting the Node.js experimental permission model.
How do I fix CVE-2024-36137?
To mitigate CVE-2024-36137, avoid using the --allow-fs-write flag with the experimental permission model in Node.js.
Who is affected by CVE-2024-36137?
CVE-2024-36137 affects users of IBM Planning Analytics versions up to 2.1 and 2.0 that utilize Node.js.
What are the implications of CVE-2024-36137?
The implications of CVE-2024-36137 include potential unauthorized changes to file ownership and permissions through the affected Node.js functionalities.
Is there a workaround for CVE-2024-36137?
A temporary workaround for CVE-2024-36137 is to refrain from using experimental features with file write permissions until a patch is available.