A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejsUpgrade npmUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade nodejs-packaging | Apr 21, 2023 | Feb 23, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 26, 2024 | Feb 23, 2023 |
| Amazon_linux_2023 | — | Upgrade npmUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade v8-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-devel | Feb 17, 2025 | Feb 16, 2023 |
| Centos_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfo | Apr 10, 2023 | Feb 23, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Feb 23, 2023 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-devel | Apr 5, 2023 | Feb 16, 2023 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-full-i18n | Apr 3, 2023 | Feb 23, 2023 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-full-i18n | Mar 5, 2024 | Feb 23, 2023 |
| Suse | — | Upgrade nodejs16-docsUpgrade npm16Upgrade corepack18Upgrade nodejs12Upgrade nodejs16Upgrade nodejs14Upgrade nodejs14-develUpgrade nodejs18-docsUpgrade corepack16Upgrade npm14Upgrade nodejs18Upgrade nodejs16-develUpgrade corepack14Upgrade nodejs18-develUpgrade npm18Upgrade npm12Upgrade nodejs14-docsUpgrade nodejs12-docsUpgrade nodejs12-devel | Mar 6, 2023 | Feb 23, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 23, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub