Vulnpedia
← Search CVEs

CVE-2026-106073

LOW 3.3

Published 2026-10-23 · Last modified 2026-10-23

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 16th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

3.3CVSS 3.0 · LOW

  • ConfidentialityLow
  • IntegrityNone
  • AvailabilityNone

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Nodejs

Products Node

Weakness (CWE)

  • CWE-284: Improper Access Control - Generic

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References and research data (JSON)

Vendor product assessments

Showing 32 of 67 vendor product statements; 35 omitted. Read the full vendor advisory.

  • nodejs as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs-docs as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-docs

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs-npm as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-npm

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs24 as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs24

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs24-full-i18n as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs24-full-i18n

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs24-npm as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs24-npm

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs26.src as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs26?arch=src

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs-docs (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:22

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs-full-i18n (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:22

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs-libs (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-libs?rpmmod=nodejs:24

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs-nodemon.src (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-nodemon?arch=src&rpmmod=nodejs:24

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs-nodemon (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-nodemon?rpmmod=nodejs:24

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs-packaging.src (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-packaging?arch=src&rpmmod=nodejs:22

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs-packaging (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-packaging?rpmmod=nodejs:22

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs.src (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs?arch=src&rpmmod=nodejs:24

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs?rpmmod=nodejs:24

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • npm (nodejs:24) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/npm?rpmmod=nodejs:24

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • v8-13.6-devel (nodejs:22) as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/v8-13.6-devel?rpmmod=nodejs:22

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs-docs (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-docs?rpmmod=nodejs:22

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs-full-i18n (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:22

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs-full-i18n (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-full-i18n?rpmmod=nodejs:26

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs-libs (nodejs:24) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs-libs?rpmmod=nodejs:24

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs.src (nodejs:24) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs?arch=src&rpmmod=nodejs:24

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/nodejs?rpmmod=nodejs:22

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • npm (nodejs:22) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/npm?rpmmod=nodejs:22

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • npm (nodejs:26) as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/npm?rpmmod=nodejs:26

    • workaround: If the Permission Model is unused, do not enable --permission. When --permission is required, avoid relying on fs.realpathSync() for security boundaries; use APIs that enforce permission checks and keep --allow-fs-read minimal (CME-1303: https://cmetaxonomy.org/entries/CME-1303.html). Apply OS-level confinement (SELinux, containers) as defense in depth (CME-301: https://cmetaxonomy.org/entries/CME-301.html; CME-702: https://cmetaxonomy.org/entries/CME-702.html).
    • none available: Fix deferred
    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • hi/nodejs as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/nodejs?repository_url=registry.redhat.io/hi/nodejs

    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs20.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs20?arch=src

    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs22.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs22?arch=src

    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs24.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs24?arch=src

    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs25.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs25?arch=src

    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00
  • nodejs26.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/nodejs26?arch=src

    Red Hat · CVE-2026-106073 · Updated 2026-10-26T11:05:40+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

1 candidate

All CVSS metrics

  • LOW 3.3 v3.0 · CNA Primary
    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  • LOW 3.3 v3.0 · NVD Secondary
    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS