Security Advisory

CVE-2024-22017

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2024-03-19 04:32:34

Last updated 2025-04-30 22:25:14

Assigner hackerone

CVSS score 7.3

State PUBLISHED

Description

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0, Node.js 20.4.0 and Node.js 21.

← Browse all CVEs View on cve.org ↗