A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade npmUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs | Apr 21, 2023 | Feb 23, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 26, 2024 | Feb 23, 2023 |
| Amazon_linux_2023 | — | Upgrade v8-develUpgrade npmUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-libs | Feb 17, 2025 | Feb 16, 2023 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-libs | Apr 10, 2023 | Feb 23, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Feb 23, 2023 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade npm | Apr 5, 2023 | Feb 16, 2023 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfo | Apr 3, 2023 | Feb 23, 2023 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade npm | Mar 5, 2024 | Feb 23, 2023 |
| Suse | — | Upgrade nodejs18-docsUpgrade corepack16Upgrade npm16Upgrade nodejs14Upgrade nodejs16-docsUpgrade nodejs18Upgrade nodejs12Upgrade corepack18Upgrade nodejs16Upgrade nodejs14-develUpgrade npm14Upgrade nodejs16-develUpgrade nodejs12-develUpgrade nodejs12-docsUpgrade corepack14Upgrade nodejs14-docsUpgrade npm18Upgrade npm12Upgrade nodejs18-devel | Mar 6, 2023 | Feb 23, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 23, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub