Node.js Trust Falls: Dangerous Module Resolution on Windows
Brief
In September of 2024, ZDI received a vulnerability submission from an anonymous researcher affecting npm CLI that revealed a fundamental design issue in Node. js . This blog details how it continues to expose applications to local privilege escalation (LPE) attacks on Windows systems, including the Discord desktop app (CVE-2026-0776 0-Day), which remains unpatched and vulnerable.
The issue is straightforward: when Node. js resolves modules, the runtime searches for packages in C:\node_modules as part of its default behavior. Since low-privileged Windows users can create this directory and plant malicious modules there, any Node. js application with missing or optional dependencies becomes vulnerable to privilege escalation.
This issue is not new. Concerned discussions about Node. js's module search path behavior date back to 2013 and 2014 .