CVE-2025-23084

MEDIUM

Node.js 18.0-18.20.6 - Path Traversal in Windows Drive Name Handling

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-23084. PoCs published by AikidoSec.

AI-analyzed exploit summary This repository contains functional exploit PoCs for multiple CVEs, including a JavaScript injection vulnerability (AIKIDO-2026-10165) and a path traversal vulnerability (CVE-2014-3744). The PoCs demonstrate the vulnerabilities and validate that the Aikido Zen Firewall blocks them.

Description

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.

Exploits (1)

github WORKING POC 6 stars

by AikidoSec · javascriptpoc

https://github.com/AikidoSec/zen-0-days/tree/main/node/CVE-2025-23084

View Code ZIP pw:eip

This repository contains functional exploit PoCs for multiple CVEs, including a JavaScript injection vulnerability (AIKIDO-2026-10165) and a path traversal vulnerability (CVE-2014-3744). The PoCs demonstrate the vulnerabilities and validate that the Aikido Zen Firewall blocks them.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Node.js applications using @enspirit/elo and st modules

No auth needed

Prerequisites: Node.js environment · Docker for containerized testing

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 27, 2026 Full analysis →

References (3)

Core 3

Core References

Vendor Advisory

https://nodejs.org/en/blog/vulnerability/january-2025-security-releases

Mailing List

http://www.openwall.com/lists/oss-security/2025/07/22/2

Vendor Advisory

https://security.netapp.com/advisory/ntap-20250321-0003/

Scores

CVSS v3 5.5

EPSS 0.0136

EPSS Percentile 68.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (1)

nodejs/node.js 18.0 - 18.20.6

Published Jan 28, 2025

Tracked Since Feb 18, 2026