Skip to main content

Insufficient Technical Documentation

CVE-2024-21890

Medium
6.5/10

Summary

The Node.js Permission Model documentation does not clarify that wildcards should only be used as the last character of a file path. For example, "--allow-fs-read=/home/node/.ssh/*.pub" will ignore pub and give access to everything after ".ssh/". This misleading documentation affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that when this CVE was issued, the permission model was an experimental feature of Node.js. This issue affects versions prior to v20.11.1 and v.21.0.x prior to v21.6.2.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-1059 - Insufficient Technical Documentation

The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, operation, etc.

References

Advisory Timeline

  • Published