CVE-2023-32006 describes a critical vulnerability in Node.js's experimental policy mechanism, affecting versions 16.x, 18.x, and 20.x, including related Fedora products. An attacker can bypass security policies by using module.constructor.createRequire() to load unauthorized modules, potentially leading to full compromise of confidentiality, integrity, and availability. With a CVSS score of 8.8 (HIGH), this network-exploitable vulnerability requires low privileges but no user interaction. While no public exploits or active exploitation have been observed, and community discussion is minimal, its high severity warrants immediate attention for users leveraging the experimental policy feature.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 16.0.0, <= 16.20.1CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
>= 18.0.0, <= 18.17.0CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
>= 20.0.0, <= 20.5.0CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
37CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | ||
38CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()
Aug 9, 2023The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x 18.x and 20.x. Please note that at the time this CVE was issued the policy is an experimental feature of Node.js.
Aug 8, 2023