QwikSec

Security Database

CVE

CWE

Training

CVE-2021-22921

Published: Jul 12, 2021

Modified: Apr 30, 2025

PUBLISHED

Description

Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking.

Vendor	Product	Versions
NodeJS	Node	affected `4.0 - < 4.` affected `5.0 - < 5.` affected `6.0 - < 6.` affected `7.0 - < 7.` affected `8.0 - < 8.*` +8 more versions

Weaknesses (CWE)

References

https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/

x_refsource_MISC

https://hackerone.com/reports/1211160

x_refsource_MISC

https://security.netapp.com/advisory/ntap-20210805-0003/

x_refsource_CONFIRM

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.