File and Path Handling

Every one of the 15 is a mark on the map. Named now: 1 to 15, most at risk first.

1. An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability affects Windows users o…CVE-2025-27210nodejs · CVSS 7.5 · 14% likely

   CWE-22

2. adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mish…CVE-2018-1002204node.js · 13% likely

   CWE-22

3. unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mi…CVE-2018-1002203node.js · 11% likely

   CWE-22

4. Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js p…CVE-2023-39332NodeJS · 2.2% likely

   CWE-22

5. A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system…CVE-2023-32004NodeJS · CVSS 8.8 · 2.1% likely

   CWE-22

6. Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dep…CVE-2022-32223NodeJS · 1.8% likely

   CWE-427

7. The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission mo…CVE-2023-32558NodeJS · 1.7% likely

   CWE-22

8. A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names a…CVE-2025-23084NodeJS · CVSS 5.6 · 1.6% likely

   CWE-22

9. A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not…CVE-2023-39331NodeJS · CVSS 7.7 · 1.5% likely

   CWE-22

10. The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the impleme…CVE-2024-21896NodeJS · CVSS 7.9 · 1.3% likely

    CWE-27

11. Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to files…CVE-2024-21891NodeJS · CVSS 7.9 · 1.2% likely

    CWE-22

12. `fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API…CVE-2023-32003NodeJS · CVSS 5.3 · 1.2% likely

    CWE-22

13. The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vuln…CVE-2024-37372NodeJS · CVSS 3.6 · 0.5% likely

    CWE-22

14. An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when runni…CVE-2023-23920NodeJS · CVSS 4.2 · 0.5% likely

    CWE-426

15. A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass w…CVE-2023-30584NodeJS · CVSS 7.7 · 0.3% likely

    CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.