CVE-2023-23918
23.02.2023, 20:15
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| nodejs | node.js | 14.0.0 ≤ 𝑥 ≤ 14.14.0 |
| nodejs | node.js | 14.0.0 ≤ 𝑥 < 14.21.3 |
| nodejs | node.js | 16.0.0 ≤ 𝑥 ≤ 16.12.0 |
| nodejs | node.js | 16.0.0 ≤ 𝑥 < 16.19.1 |
| nodejs | node.js | 18.0.0 ≤ 𝑥 ≤ 18.11.0 |
| nodejs | node.js | 18.0.0 ≤ 𝑥 < 18.14.1 |
| nodejs | node.js | 19.0.0 ≤ 𝑥 < 19.6.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| nodejs12 |
| ||||||||
| nodejs12-devel |
| ||||||||
| nodejs12-docs |
| ||||||||
| nodejs14 |
| ||||||||
| nodejs14-devel |
| ||||||||
| nodejs14-docs |
| ||||||||
| nodejs16 |
| ||||||||
| nodejs16-devel |
| ||||||||
| nodejs16-docs |
| ||||||||
| nodejs18 |
| ||||||||
| nodejs18-devel |
| ||||||||
| nodejs18-docs |
| ||||||||
| npm12 |
| ||||||||
| npm14 |
| ||||||||
| npm16 |
| ||||||||
| npm18 |
|
Red Hat Enterprise Linux Releases