A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade nodejs-packaging | Apr 21, 2023 | Feb 23, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 26, 2024 | Feb 23, 2023 |
| Amazon_linux_2023 | — | Upgrade npmUpgrade nodejs-debugsourceUpgrade v8-develUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-docs | Feb 17, 2025 | Feb 16, 2023 |
| Centos_linux | — | Upgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfo | Apr 10, 2023 | Feb 23, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Feb 23, 2023 |
| Oracle_linux | — | Upgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade npm | Apr 5, 2023 | Feb 16, 2023 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-full-i18n | Apr 3, 2023 | Feb 23, 2023 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-libs-debuginfo | Mar 5, 2024 | Feb 23, 2023 |
| Suse | — | Upgrade nodejs14-develUpgrade corepack16Upgrade npm14Upgrade nodejs16-docsUpgrade corepack18Upgrade nodejs18Upgrade nodejs14Upgrade nodejs12Upgrade nodejs18-docsUpgrade npm16Upgrade nodejs16Upgrade nodejs12-docsUpgrade nodejs16-develUpgrade nodejs12-develUpgrade nodejs14-docsUpgrade nodejs18-develUpgrade npm12Upgrade corepack14Upgrade npm18 | Mar 6, 2023 | Feb 23, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 23, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub