CVE-2023-38704

CVE-2023-38704 is a critical remote code execution vulnerability (CVSS 9.8) affecting datadoghq's import-in-the-middle module loading interceptor prior to version 1.4.2. It arises when an application directly passes unvalidated user-supplied input to the import() function, allowing an attacker to execute arbitrary code. The attack requires no user interaction and has low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code, the vulnerability has garnered significant community discussion, indicating awareness and potential future exploitation.