{"id":"CVE-2024-37372","aliases":["ALPINE-CVE-2024-37372","BIT-node-2024-37372","BIT-node-min-2024-37372","EUVD-2024-36998","GHSA-7975-2qr9-g542","MGASA-2024-0282","SUSE-SU-2024:2543-1","SUSE-SU-2024:2574-1","openSUSE-SU-2024:14214-1","openSUSE-SU-2024:14435-1","openSUSE-SU-2025:15802-1","openSUSE-SU-2026:11110-1"],"status":"published","title":"The Permission Model assumes that any path starting with two backslashes \\ has a four-character...","description":"The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.","severity":{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00488,"percentile":0.42262,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-07-17T07:51:52Z","modified":"2026-07-14T08:03:32Z","fixes":[{"ecosystem":"Bitnami","package":"node","fixed_in":["20.15.1","22.4.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["20.18.1","22.12.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"19.0.0"},{"fixed":"20.15.1"},{"introduced":"21.0.0"},{"fixed":"22.4.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"19.0.0"},{"fixed":"20.18.1"},{"introduced":"21.0.0"},{"fixed":"22.12.0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.6.0-1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:9","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.22-0.10.8.2.1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150500.11.12.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150500.11.12.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150600.3.3.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-150600.3.3.2"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.10.0-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.11.1-2.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nodejs26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.3.1-1.1"}]}],"bundled":37}],"products":[{"vendor":"nodejs","product":"node"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2024/07/11/6","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/19/3","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20250502-0010/","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37372","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20250502-0010"},{"url":"https://github.com/advisories/GHSA-7975-2qr9-g542"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-37372","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0282.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33415","tags":["report"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.6.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.5.1","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.5.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.4.1","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.3.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.2.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.1.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v22.0.0","tags":["web"]},{"url":"https://github.com/yarnpkg/yarn/releases/tag/v1.22.22","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242543-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227554","tags":["report"]},{"url":"https://bugzilla.suse.com/1227560","tags":["report"]},{"url":"https://bugzilla.suse.com/1227561","tags":["report"]},{"url":"https://bugzilla.suse.com/1227562","tags":["report"]},{"url":"https://bugzilla.suse.com/1227563","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37372","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242574-1/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OWCPL7VTEVIGUDVKLEV2D2ITNTWKC4AZ/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48936","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-37372","description":"The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.","status":"published","published":"2025-01-09T00:33:47.662Z","modified":"2025-05-02T23:03:00.375Z","cvss":[{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:00.585327Z"}],"euvd":[{"id":"EUVD-2024-36998","description":"The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.","status":"published","published":"2025-01-09T00:33:47Z","modified":"2025-05-02T23:03:00Z","cvss":[{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T20:51:54.869696Z"}],"ghsa":[{"id":"GHSA-7975-2qr9-g542","title":"The Permission Model assumes that any path starting with two backslashes \\ has a four-character...","description":"The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.","status":"published","published":"2025-01-09T03:30:48Z","modified":"2025-05-03T00:30:32Z","cvss":[{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:02:06.423076Z"}],"nvd":[{"id":"CVE-2024-37372","description":"The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.","status":"published","published":"2025-01-09T01:15:08.5Z","modified":"2026-06-17T07:38:14.667Z","cvss":[{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:41.838321Z"}],"osv":[{"id":"ALPINE-CVE-2024-37372","description":"The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.","status":"withdrawn","published":"2025-01-09T01:15:08.5Z","modified":"2026-07-14T08:03:32.089622813Z","cvss":[{"version":"3.0","score":3.6,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BIT-node-2024-37372","description":"The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.","status":"published","published":"2025-01-10T19:16:12.087Z","modified":"2025-05-03T06:34:12.721Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2024-37372","description":"The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.","status":"published","published":"2025-01-10T19:16:10.688Z","modified":"2025-05-03T06:34:12.721Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CVE-2024-37372","description":"The Permission Model assumes that any path starting with two backslashes \\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.","status":"published","published":"2025-01-09T01:15:08Z","modified":"2026-06-24T09:14:34.837401447Z","updated_at":"2026-11-02T15:44:41.133403Z"},{"id":"MGASA-2024-0282","title":"Updated nodejs \u0026 yarnpkg packages fix security vulnerabilities","description":"Nodejs 22 is the new active LTS branch and 5 CVE are fixed.\nCVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)\nCVE-2024-22020 - Bypass network import restriction via data URL (Medium)\nCVE-2024-22018 - fs.lstat bypasses permission model (Low)\nCVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)\nCVE-2024-37372 - Permission model improperly processes UNC paths (Low)\nyarn package is updated with npm 10.8.2\n","status":"published","published":"2024-08-28T17:11:44Z","modified":"2026-04-16T04:40:55.567077754Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14214-1","title":"corepack20-20.15.1-1.1 on GA media","description":"These are all security issues fixed in the corepack20-20.15.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-22T00:00:00Z","modified":"2026-02-04T02:56:34.982757Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14435-1","title":"corepack22-22.10.0-1.1 on GA media","description":"These are all security issues fixed in the corepack22-22.10.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-29T00:00:00Z","modified":"2026-02-04T02:15:17.587107Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:15802-1","title":"corepack24-24.11.1-2.1 on GA media","description":"These are all security issues fixed in the corepack24-24.11.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-12-08T00:00:00Z","modified":"2026-03-23T04:54:11.929189Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11110-1","title":"nodejs26-26.3.1-1.1 on GA media","description":"These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-06-24T09:00:19.692832432Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"SUSE-SU-2024:2543-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.15.1:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n- CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)\n- CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)\n- CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)\n\nChanges in 20.15.0:\n\n- test_runner: support test plans\n- inspector: introduce the --inspect-wait flag\n- zlib: expose zlib.crc32()\n- cli: allow running wasm in limited vmem with --disable-wasm-trap-handler\n\nChanges in 20.14.0\n\n- src,permission: throw async errors on async APIs\n- test_runner: support forced exit\n\nChanges in 20.13.1:\n\n- buffer: improve base64 and base64url performance\n- crypto: deprecate implicitly shortened GCM tags\n- events,doc: mark CustomEvent as stable\n- fs: add stacktrace to fs/promises\n- report: add --report-exclude-network option\n- src: add uv_get_available_memory to report and process\n- stream: support typed arrays\n- util: support array of formats in util.styleText\n- v8: implement v8.queryObjects() for memory leak regression testing\n- watch: mark as stable\n","status":"published","published":"2024-07-17T07:51:52Z","modified":"2026-02-04T03:44:28.883947Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2574-1","title":"Security update for nodejs20","description":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.15.1:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n- CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)\n- CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)\n- CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)\n\nChanges in 20.15.0:\n\n- test_runner: support test plans\n- inspector: introduce the --inspect-wait flag\n- zlib: expose zlib.crc32()\n- cli: allow running wasm in limited vmem with --disable-wasm-trap-handler\n\nChanges in 20.14.0\n\n- src,permission: throw async errors on async APIs\n- test_runner: support forced exit\n\nChanges in 20.13.1:\n\n- buffer: improve base64 and base64url performance\n- crypto: deprecate implicitly shortened GCM tags\n- events,doc: mark CustomEvent as stable\n- fs: add stacktrace to fs/promises\n- report: add --report-exclude-network option\n- src: add uv_get_available_memory to report and process\n- stream: support typed arrays\n- util: support array of formats in util.styleText\n- v8: implement v8.queryObjects() for memory leak regression testing\n- watch: mark as stable\n","status":"published","published":"2024-07-22T10:35:15Z","modified":"2026-02-04T03:46:39.426759Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}