VULNERABILITY INTELLIGENCE

CVE-2021-22921

CVSS score7.8 HIGH

EPSS probability7.41%

CISA KEVNot currently listed

Published2021-07-12

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.

Weakness classification

support@hackerone.com: CWE-732
nvd@nist.gov: CWE-732

Primary references

support@hackerone.com — Patch, Third Party Advisory
support@hackerone.com — Exploit, Third Party Advisory
support@hackerone.com — Patch, Release Notes, Vendor Advisory
support@hackerone.com — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory