The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-develUpgrade npmUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-packaging | Aug 3, 2023 | Jul 31, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 21, 2024 | Nov 22, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejsUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade v8-develUpgrade nodejs-debuginfo | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-docs | Aug 1, 2023 | Jul 31, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Nov 23, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Nov 23, 2023 |
| Oracle_linux | — | Upgrade nodejsUpgrade npmUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-packaging | May 21, 2024 | Jun 20, 2023 |
| Redhat_linux | — | No solution existsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-debugsource | Aug 1, 2023 | Jul 31, 2023 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debuginfoUpgrade npm | Mar 5, 2024 | Nov 23, 2023 |
| Suse | — | Upgrade nodejs12Upgrade corepack16Upgrade nodejs12-develUpgrade nodejs16Upgrade nodejs16-docsUpgrade nodejs18Upgrade nodejs16-develUpgrade npm14Upgrade corepack18Upgrade nodejs14-develUpgrade nodejs18-develUpgrade npm16Upgrade nodejs18-docsUpgrade npm18Upgrade nodejs14Upgrade nodejs14-docsUpgrade npm12Upgrade nodejs12-docsUpgrade corepack14 | Jun 28, 2023 | Jun 27, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 22, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub