← Back

CVE-2023-23920

nvd nist
Published: Feb 23, 2023Modified: Jun 17, 2026

JSON object

Loading...
4.2
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Exploitability: 0.6 / Impact: 3.6
Source: NVD

Description

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.

Affected (8)

Nodejs
1 product
Node.js
Debian
1 product
Debian Linux
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Nodejs
Node.js
From 14.0.0 to 14.14.0
Node.js
From 16.0.0 to 16.12.0
Node.js
From 18.0.0 to 18.11.0
Node.js
From 19.0.0 to 19.6.1
Node.js
From 14.0.0 to 14.21.3
Node.js
From 16.0.0 to 16.19.1
Node.js
From 18.0.0 to 18.14.1
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 10.0

Related CWEs

CWE-426
Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

References (8)

Source: support@hackerone.com
Mailing List
Source: support@hackerone.com
PatchVendor Advisory
Source: support@hackerone.com
Source: support@hackerone.com
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.