← Back

CVE-2023-23920

nvd nist
Published: Feb 23, 2023Modified: Jun 17, 2026

JSON object

Loading...
4.2
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Exploitability: 0.6 / Impact: 3.6
Source: NVD

Description

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.

Affected (8)

Nodejs
1 product
Node.js
Debian
1 product
Debian Linux
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Nodejs
Node.js
14.0.0 ≤ version ≤ 14.14.0
Node.js
16.0.0 ≤ version ≤ 16.12.0
Node.js
18.0.0 ≤ version ≤ 18.11.0
Node.js
19.0.0 ≤ version < 19.6.1
Node.js
14.0.0 ≤ version < 14.21.3
Node.js
16.0.0 ≤ version < 16.19.1
Node.js
18.0.0 ≤ version < 18.14.1
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 10.0

Related CWEs

CWE-426
Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

References (8)

Source: support@hackerone.com
Mailing List
Source: support@hackerone.com
PatchVendor Advisory
Source: support@hackerone.com
Source: support@hackerone.com
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.