Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

Node.js before 20.14.0-1 allows code escape

published 7 years ago
Summary

Older versions of the Node.js runtime may let specially crafted code break out of the safe sandbox it normally provides. This could let an attacker run commands or access data they shouldn't. Upgrade Node.js to version 20.14.0-1 or newer to close the risk.

What to do
  • Update azure nodejs to version 20.14.0-1.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure nodejs < 20.14.0-1
Fix: upgrade to 20.14.0-1
Original advisory text
CVE-2019-10906 affecting package nodejs for versions less than 20.14.0-1
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.6 High
Timeline
Published7 Apr 2019
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-41949 · OSV
Track software like this
Free during beta