A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18n | Apr 21, 2023 | Feb 23, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 26, 2024 | Feb 23, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejsUpgrade v8-devel | Feb 17, 2025 | Feb 16, 2023 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-debugsource | Apr 10, 2023 | Feb 23, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Feb 23, 2023 |
| Oracle_linux | — | Upgrade npmUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-docs | Apr 5, 2023 | Feb 16, 2023 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs | Apr 3, 2023 | Feb 23, 2023 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-libs | Mar 5, 2024 | Feb 23, 2023 |
| Suse | — | Upgrade nodejs18-docsUpgrade nodejs12Upgrade nodejs16-docsUpgrade corepack18Upgrade corepack16Upgrade nodejs16Upgrade nodejs14-develUpgrade nodejs18Upgrade npm16Upgrade npm14Upgrade nodejs14Upgrade nodejs16-develUpgrade nodejs12-docsUpgrade npm18Upgrade nodejs12-develUpgrade nodejs18-develUpgrade npm12Upgrade nodejs14-docsUpgrade corepack14 | Mar 6, 2023 | Feb 23, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 23, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub