A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-docsUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-libs | Sep 28, 2023 | Aug 24, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 26, 2024 | Aug 24, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejsUpgrade npmUpgrade nodejs-debugsourceUpgrade v8-develUpgrade nodejs-libsUpgrade nodejs-debuginfoUpgrade nodejs-full-i18n | Feb 17, 2025 | Aug 9, 2023 |
| Centos_linux | — | Upgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packaging-bundler | Sep 27, 2023 | Aug 24, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Aug 24, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Aug 24, 2023 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-devel | Sep 28, 2023 | Aug 9, 2023 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18n | Sep 27, 2023 | Aug 24, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 24, 2023 |
| Suse | — | Upgrade nodejs18Upgrade npm12Upgrade corepack14Upgrade nodejs16Upgrade nodejs18-docsUpgrade nodejs18-develUpgrade nodejs14Upgrade nodejs16-develUpgrade corepack18Upgrade nodejs12-docsUpgrade nodejs14-docsUpgrade nodejs12-develUpgrade nodejs12Upgrade npm14Upgrade nodejs14-develUpgrade npm16Upgrade npm18Upgrade corepack16Upgrade nodejs16-docs | Aug 15, 2023 | Aug 14, 2023 |
| Ubuntu | — | Upgrade libnode72Upgrade nodejsUpgrade libnode108 | Jul 1, 2024 | Aug 24, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub