CVE-2023-23918

Published: Feb 23, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.

Affected (7)

Products: Nodejs: Node.js

Nodejs

1 product

Node.js

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	14.0.0 ≤ version ≤ 14.14.0
Nodejs Node.js	16.0.0 ≤ version ≤ 16.12.0
Nodejs Node.js	18.0.0 ≤ version ≤ 18.11.0
Nodejs Node.js	19.0.0 ≤ version < 19.6.1
Nodejs Node.js	14.0.0 ≤ version < 14.21.3
Nodejs Node.js	16.0.0 ≤ version < 16.19.1
Nodejs Node.js	18.0.0 ≤ version < 18.14.1

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/

Source: support@hackerone.com

PatchVendor Advisory

https://security.netapp.com/advisory/ntap-20230316-0008/

Source: support@hackerone.com

https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://security.netapp.com/advisory/ntap-20230316-0008/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.