CVE-2023-23918

Published: Feb 23, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.

Affected (7)

Products: Nodejs: Node.js

Nodejs

1 product

Node.js

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 14.0.0 to 14.14.0
Nodejs Node.js	From 16.0.0 to 16.12.0
Nodejs Node.js	From 18.0.0 to 18.11.0
Nodejs Node.js	From 19.0.0 to 19.6.1
Nodejs Node.js	From 14.0.0 to 14.21.3
Nodejs Node.js	From 16.0.0 to 16.19.1
Nodejs Node.js	From 18.0.0 to 18.14.1

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/

Source: support@hackerone.com

PatchVendor Advisory

https://security.netapp.com/advisory/ntap-20230316-0008/

Source: support@hackerone.com

https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://security.netapp.com/advisory/ntap-20230316-0008/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.