CVE-2018-7160

CVE-2018-7160 describes a critical DNS rebinding vulnerability affecting Node.js versions 6.x and later, specifically within its inspector component. This flaw allows remote code execution if a Node.js process with an active debug port is running on the same or a networked machine, enabling a malicious website to bypass same-origin policy and connect as a debugger. With a CVSS score of 8.8 (High), the attack requires user interaction (UI:R) but is network-based (AV:N) with low attack complexity (AC:L), leading to high confidentiality, integrity, and availability impacts (C:H/I:H/A:H). Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.