A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade npmUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs | Sep 28, 2023 | Aug 24, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 26, 2024 | Aug 24, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejsUpgrade nodejs-debugsourceUpgrade v8-develUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-devel | Feb 17, 2025 | Aug 9, 2023 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-nodemon | Sep 27, 2023 | Aug 24, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Aug 24, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Aug 24, 2023 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-devel | Sep 28, 2023 | Aug 9, 2023 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18n | Sep 27, 2023 | Aug 24, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 24, 2023 |
| Suse | — | Upgrade nodejs18-develUpgrade nodejs18-docsUpgrade nodejs14Upgrade corepack18Upgrade nodejs12-docsUpgrade nodejs18Upgrade corepack14Upgrade nodejs16-develUpgrade nodejs16Upgrade npm12Upgrade npm18Upgrade nodejs14-docsUpgrade nodejs12Upgrade nodejs12-develUpgrade nodejs16-docsUpgrade nodejs14-develUpgrade npm14Upgrade npm16Upgrade corepack16 | Aug 15, 2023 | Aug 14, 2023 |
| Ubuntu | — | Upgrade libnode108Upgrade nodejsUpgrade libnode72 | Jul 1, 2024 | Aug 24, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub