{"id":"ALPINE-CVE-2024-36137","details":"A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\r\n\r\nNode.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a \"read-only\" file descriptor to change the owner and permissions of a file.","modified":"2025-12-03T22:56:16.130857Z","published":"2024-09-07T16:15:02.410Z","upstream":["CVE-2024-36137"],"references":[{"type":"ADVISORY","url":"https://security.alpinelinux.org/vuln/CVE-2024-36137"}],"affected":[{"package":{"name":"nodejs","ecosystem":"Alpine:v3.19","purl":"pkg:apk/alpine/nodejs?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}],"versions":["10.13.0-r0","10.14.0-r0","10.14.1-r0","10.14.2-r0","10.15.1-r0","10.15.3-r0","10.16.0-r0","10.16.1-r0","10.16.2-r0","10.16.3-r0","12.13.0-r0","12.13.0-r1","12.13.1-r0","12.14.0-r0","12.14.1-r0","12.15.0-r0","12.15.0-r1","12.15.0-r2","12.16.2-r0","12.16.3-r0","12.16.3-r1","12.17.0-r0","12.18.0-r0","12.18.0-r1","12.18.0-r2","12.18.2-r0","12.18.3-r0","12.18.4-r0","12.19.0-r0","14.15.1-r0","14.15.3-r0","14.15.3-r1","14.15.3-r2","14.15.4-r0","14.15.5-r0","14.16.0-r0","14.16.0-r1","14.16.1-r0","14.16.1-r1","14.16.1-r2","14.17.0-r0","14.17.1-r0","14.17.2-r0","14.17.3-r0","14.17.4-r0","14.17.5-r0","14.17.6-r0","14.17.6-r1","14.18.0-r0","14.18.1-r0","14.18.1-r1","16.13.0-r0","16.13.1-r0","16.13.1-r1","16.13.2-r0","16.13.2-r1","16.14.2-r0","16.14.2-r1","16.15.0-r0","16.15.0-r1","16.16.0-r0","16.16.0-r1","16.17.0-r0","16.17.1-r0","16.18.0-r0","16.18.0-r1","18.12.0-r0","18.12.1-r0","18.13.0-r0","18.14.0-r0","18.14.1-r0","18.14.2-r0","18.15.0-r0","18.15.0-r1","18.16.0-r0","18.16.0-r1","18.16.1-r0","18.17.0-r0","18.17.1-r0","18.18.0-r0","18.18.1-r0","18.18.2-r0","18.18.2-r1","20.10.0-r0","20.10.0-r1","20.11.0-r0","20.11.1-r0","20.12.1-r0","20.9.0-r0","4.4.3-r0","4.4.4-r0","4.4.5-r0","4.4.7-r0","4.5.0-r0","6.10.0-r0","6.10.1-r0","6.10.3-r0","6.11.0-r0","6.11.1-r0","6.11.1-r1","6.11.1-r2","6.11.2-r0","6.11.3-r0","6.11.4-r0","6.11.5-r0","6.9.1-r0","6.9.1-r1","6.9.2-r0","6.9.4-r0","6.9.4-r1","6.9.5-r0","6.9.5-r1","8.10.0-r0","8.11.0-r0","8.11.0-r1","8.11.1-r0","8.11.1-r1","8.11.1-r2","8.11.2-r0","8.11.3-r0","8.11.3-r1","8.11.3-r2","8.11.3-r3","8.11.4-r0","8.12.0-r0","8.9.0-r0","8.9.1-r0","8.9.2-r0","8.9.3-r0","8.9.3-r1","8.9.4-r0"],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2024-36137.json"}},{"package":{"name":"nodejs","ecosystem":"Alpine:v3.20","purl":"pkg:apk/alpine/nodejs?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}],"versions":["10.13.0-r0","10.14.0-r0","10.14.1-r0","10.14.2-r0","10.15.1-r0","10.15.3-r0","10.16.0-r0","10.16.1-r0","10.16.2-r0","10.16.3-r0","12.13.0-r0","12.13.0-r1","12.13.1-r0","12.14.0-r0","12.14.1-r0","12.15.0-r0","12.15.0-r1","12.15.0-r2","12.16.2-r0","12.16.3-r0","12.16.3-r1","12.17.0-r0","12.18.0-r0","12.18.0-r1","12.18.0-r2","12.18.2-r0","12.18.3-r0","12.18.4-r0","12.19.0-r0","14.15.1-r0","14.15.3-r0","14.15.3-r1","14.15.3-r2","14.15.4-r0","14.15.5-r0","14.16.0-r0","14.16.0-r1","14.16.1-r0","14.16.1-r1","14.16.1-r2","14.17.0-r0","14.17.1-r0","14.17.2-r0","14.17.3-r0","14.17.4-r0","14.17.5-r0","14.17.6-r0","14.17.6-r1","14.18.0-r0","14.18.1-r0","14.18.1-r1","16.13.0-r0","16.13.1-r0","16.13.1-r1","16.13.2-r0","16.13.2-r1","16.14.2-r0","16.14.2-r1","16.15.0-r0","16.15.0-r1","16.16.0-r0","16.16.0-r1","16.17.0-r0","16.17.1-r0","16.18.0-r0","16.18.0-r1","18.12.0-r0","18.12.1-r0","18.13.0-r0","18.14.0-r0","18.14.1-r0","18.14.2-r0","18.15.0-r0","18.15.0-r1","18.16.0-r0","18.16.0-r1","18.16.1-r0","18.17.0-r0","18.17.1-r0","18.18.0-r0","18.18.1-r0","18.18.2-r0","18.18.2-r1","20.10.0-r0","20.10.0-r1","20.11.0-r0","20.11.1-r0","20.12.0-r0","20.12.1-r0","20.12.2-r0","20.13.1-r0","20.9.0-r0","4.4.3-r0","4.4.4-r0","4.4.5-r0","4.4.7-r0","4.5.0-r0","6.10.0-r0","6.10.1-r0","6.10.3-r0","6.11.0-r0","6.11.1-r0","6.11.1-r1","6.11.1-r2","6.11.2-r0","6.11.3-r0","6.11.4-r0","6.11.5-r0","6.9.1-r0","6.9.1-r1","6.9.2-r0","6.9.4-r0","6.9.4-r1","6.9.5-r0","6.9.5-r1","8.10.0-r0","8.11.0-r0","8.11.0-r1","8.11.1-r0","8.11.1-r1","8.11.1-r2","8.11.2-r0","8.11.3-r0","8.11.3-r1","8.11.3-r2","8.11.3-r3","8.11.4-r0","8.12.0-r0","8.9.0-r0","8.9.1-r0","8.9.2-r0","8.9.3-r0","8.9.3-r1","8.9.4-r0"],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2024-36137.json"}},{"package":{"name":"nodejs","ecosystem":"Alpine:v3.21","purl":"pkg:apk/alpine/nodejs?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2024-36137.json"}},{"package":{"name":"nodejs","ecosystem":"Alpine:v3.22","purl":"pkg:apk/alpine/nodejs?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2024-36137.json"}},{"package":{"name":"nodejs","ecosystem":"Alpine:v3.23","purl":"pkg:apk/alpine/nodejs?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.15.1-r0"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2024-36137.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}]}