Fluid Attacks Database

Description

A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.21	nodejs	>=0 <18.14.1-r0	18.14.1-r0
debian 14	nodejs	>=0 <18.19.0+dfsg-2	18.19.0+dfsg-2
alpine v3.14	nodejs	>=0 <14.21.3-r0	14.21.3-r0
alpine v3.15	nodejs	>=0 <16.19.1-r0	16.19.1-r0
alpine v3.16	nodejs	>=0 <16.19.1-r0	16.19.1-r0
alpine v3.17	nodejs	>=0 <18.14.1-r0	18.14.1-r0
alpine v3.18	nodejs	>=0 <18.14.1-r0	18.14.1-r0
alpine v3.19	nodejs	>=0 <18.14.1-r0	18.14.1-r0
alpine v3.20	nodejs	>=0 <18.14.1-r0	18.14.1-r0
alpine v3.22	nodejs	>=0 <18.14.1-r0	18.14.1-r0

1-10 of 19

Aliases

1. CVE-2023-239182. NVD-2023-239183. OSV-ALPINE-2023-239184. OSV-2023-239185. OSV-DEBIAN-2023-239186. GCVE-2023-239187. SECURITY-CVE-2023-239188. SECURITY-TRACKER-CVE-2023-239189. https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23918.json10. security.netapp.com

References

1. https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.