A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-nodemon | Sep 28, 2023 | Aug 24, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 26, 2024 | Aug 24, 2023 |
| Amazon_linux_2023 | — | Upgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-debugsourceUpgrade v8-develUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-libs-debuginfo | Feb 17, 2025 | Aug 9, 2023 |
| Centos_linux | — | Upgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-docs | Sep 27, 2023 | Aug 24, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Aug 24, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Aug 24, 2023 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-full-i18n | Sep 28, 2023 | Aug 9, 2023 |
| Redhat_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18n | Sep 27, 2023 | Aug 24, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 24, 2023 |
| Suse | — | Upgrade npm16Upgrade nodejs12-develUpgrade nodejs12Upgrade nodejs14-develUpgrade nodejs16-docsUpgrade npm14Upgrade npm18Upgrade corepack16Upgrade nodejs14-docsUpgrade corepack14Upgrade nodejs16-develUpgrade nodejs12-docsUpgrade nodejs14Upgrade nodejs16Upgrade corepack18Upgrade npm12Upgrade nodejs18-develUpgrade nodejs18Upgrade nodejs18-docs | Aug 15, 2023 | Aug 14, 2023 |
| Ubuntu | — | Upgrade libnode72Upgrade nodejsUpgrade libnode108 | Jul 1, 2024 | Aug 24, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub