CVE-2024-37372: 
Node.js vulnerability analysis and mitigation

A low severity vulnerability (CVE-2024-37372) was identified in Node.js affecting the experimental Permission Model. The vulnerability exists in Node.js versions v22.x and v20.x, specifically impacting Windows users. The issue was discovered and disclosed in July 2024 (Node.js Blog).

The vulnerability stems from an incorrect assumption in the Permission Model where any path starting with two backslashes () is presumed to have a four-character prefix that can be ignored. However, this assumption is not always valid, leading to vulnerable edge cases in path handling (NVD). The vulnerability has been assigned a CVSS v3.0 base score of 3.6 (LOW) with the vector string CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N (Node.js Blog).

The vulnerability affects Windows users of the Node.js Permission Model in versions v22.x and v20.x. The impact is considered low severity, potentially allowing exploitation of edge cases in path handling (Node.js Blog).

The issue has been addressed in the July 2024 security releases of Node.js. Users are recommended to upgrade to the patched versions: Node.js v22.4.1, v20.15.1, or v18.20.4 (Node.js Blog).