A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade npmUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade nodejs-full-i18n | Sep 28, 2023 | Aug 24, 2023 |
| Alpine Linux | — | Upgrade nodejs | Mar 26, 2024 | Aug 24, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade npmUpgrade v8-develUpgrade nodejs-debugsource | Feb 17, 2025 | Aug 9, 2023 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-libs | Sep 27, 2023 | Aug 24, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Aug 24, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Aug 24, 2023 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade npm | Sep 28, 2023 | Aug 9, 2023 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade npm | Sep 27, 2023 | Aug 24, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 24, 2023 |
| Suse | — | Upgrade corepack14Upgrade nodejs14Upgrade nodejs18-develUpgrade nodejs18Upgrade nodejs16-develUpgrade nodejs12-docsUpgrade corepack18Upgrade nodejs18-docsUpgrade nodejs16Upgrade npm12Upgrade nodejs14-docsUpgrade npm14Upgrade nodejs14-develUpgrade corepack16Upgrade nodejs12Upgrade nodejs12-develUpgrade nodejs16-docsUpgrade npm18Upgrade npm16 | Aug 15, 2023 | Aug 14, 2023 |
| Ubuntu | — | Upgrade libnode72Upgrade libnode108Upgrade nodejs | Jul 1, 2024 | Aug 24, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 24, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub