CVE-2017-14849

5

MEDIUMCVSS v2

Published

September 28, 2017

Affected

3 projects

Assigned by

MITRE

Severity scale

010

Description

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.

nodejs

Python Package IndexPython bindings and utils for Node.js and io.js

= 8.5.0NVD

nodejs

NPM

= 8.5.0NVD

Node.js

NuGet Gallery

More on this CVE

NVD↗GitHub Advisory↗

Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js' package ecosystem, npm, is the largest ecosystem of open source libraries in the world.

= 8.5.0NVD

Security Advisories

CVE-2017-14849

Description

More on this CVE