A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-docsUpgrade nodejsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-packaging | Apr 21, 2023 | Feb 23, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 26, 2024 | Feb 23, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejsUpgrade v8-develUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-libs | Feb 17, 2025 | Feb 16, 2023 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-packaging-bundler | Apr 10, 2023 | Feb 23, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Feb 23, 2023 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-packaging-bundler | Apr 5, 2023 | Feb 16, 2023 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-debuginfo | Apr 3, 2023 | Feb 23, 2023 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade npmUpgrade nodejs-develUpgrade nodejs-debuginfo | Mar 5, 2024 | Feb 23, 2023 |
| Suse | — | Upgrade corepack18Upgrade nodejs16-docsUpgrade nodejs18-docsUpgrade npm16Upgrade corepack16Upgrade npm14Upgrade nodejs14Upgrade nodejs14-develUpgrade nodejs18Upgrade nodejs16Upgrade nodejs12Upgrade corepack14Upgrade nodejs16-develUpgrade npm18Upgrade nodejs12-develUpgrade nodejs14-docsUpgrade npm12Upgrade nodejs18-develUpgrade nodejs12-docs | Mar 6, 2023 | Feb 23, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 23, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub