CVE-2025-23084

MEDIUM5.5EPSS 1.3%
發布日:2025/1/28修改日:2025/12/3
也稱為:ALPINE-CVE-2025-23084

描述

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.

受影響套件(3)

  • Alpine/nodejsfrom 0, < 22.13.1-r0
  • Bitnami/nodefrom 0, < 18.20.6, >= 19.0.0, < 20.18.2, >= 21.0.0, < 22.13.1, >= 23.0.0, < 23.8.0
  • Bitnami/node-minfrom 0, < 18.20.6, >= 19.0.0, < 20.18.2, >= 21.0.0, < 22.13.1, >= 23.0.0, < 23.8.0

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

參考連結(5)