CVE-2024-37372 Path traversal in Node
Attackers can bypass path restrictions in the Node.js Permission Model by exploiting backslash handling, potentially reading or modifying unauthorized files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-37372?
CVE-2024-37372 is a low-severity path traversal vulnerability in NodeJS Node, published on 9 Jan 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.
Weakness: CWE-22
Which versions are affected by CVE-2024-37372?
2 open source packages ship an affected version, including node and node-min.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | From 19.0.0 | 20.15.1, 22.4.1 |
node-min Bitnami | From 19.0.0 | 20.18.1, 22.12.0 |
How do I fix CVE-2024-37372?
Upgrade node to a fixed version for your release line: 20.15.1 or 22.4.1.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-37372 being exploited?
There is no known exploitation of CVE-2024-37372 in the wild and no public exploit code.
Sources
Also known as BIT-node-2024-37372, BIT-node-min-2024-37372, CLEANSTART-2026-TE76702, GHSA-7975-2qr9-g542.