Detections
Analytics

SCA: security update for pkg (GHSA-22r3-9w55-cj54)

high Tenable Cloud Security Plugin ID 446917

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - pkg is tool design to bundle Node.js projects into an executables. Any native code packages built by `pkg`
 are written to a hardcoded directory. On unix systems, this is `/tmp/pkg/*` which is a shared directory
 for all users on the same local system. There is no uniqueness to the package names within this directory,
 they are predictable. An attacker who has access to the same local system has the ability to replace the
 genuine executables in the shared directory with malicious executables of the same name. A user may then
 run the malicious executable without realising it has been modified. This package is deprecated.
 Therefore, there will not be a patch provided for this vulnerability. To check if your executable build by
 pkg depends on native code and is vulnerable, run the executable and check if `/tmp/pkg/` was created.
 Users should transition to actively maintained alternatives. We would recommend investigating Node.js 21’s
 support for single executable applications. Given the decision to deprecate the pkg package, there are no
 official workarounds or remediations provided by our team. Users should prioritize migrating to other
 packages that offer similar functionality with enhanced security. (CVE-2024-24828)

Solution

There is no known solution at this time.

See Also

https://github.com/advisories/GHSA-22r3-9w55-cj54

Plugin Details

Severity: High

ID: 446917

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/31/2026

Updated: 8/31/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.63

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2024-24828

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/9/2024

Vulnerability Publication Date: 2/9/2024

Reference Information

CVE: CVE-2024-24828

cwe: CWE-276