CVE-2023-45311

CVE-2023-45311 describes a critical vulnerability in the fsevents project, specifically versions prior to 1.2.11. The vulnerability stems from its dependency on a potentially compromised S3 URL, which could allow an adversary to execute arbitrary code if a JavaScript project using fsevents distributed code obtained from that URL during a period of adversarial control. With a CVSS score of 9.8 (CRITICAL), this vulnerability presents a significant risk due to its network-based attack vector, low attack complexity, and high potential for impact across confidentiality, integrity, and availability. While the URL is reportedly no longer under adversarial control, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.