-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions that monkey-patching Buffer.prototype.utf8Write is the mechanism for exploitation. This allows an attacker to bypass the path sanitization performed by path.resolve() when paths are converted to Buffers. While path.resolve() and Buffer.from() are involved in the vulnerable code path, the modifiable component that enables the traversal is Buffer.prototype.utf8Write. Without the specific patch, the exact file path and direct code evidence are unavailable, hence the medium confidence. The HackerOne report and oss-security mailing list did not provide direct links to commits. The Node.js blog post confirms the CVE and its description but also does not link to a specific commit for this CVE.