CVE-2023-23918

Summary

CVE	CVE-2023-23918
State	PUBLISHED
Assigner	hackerone
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-02-23 20:15:13 UTC
Updated	2026-10-24 13:10:00 UTC
Description	A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.

Risk And Classification

Primary CVSS: v3.1 7.5 HIGH from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem Types: CWE-863 | Privilege Escalation (CAPEC-233) | CWE-863 CWE-863 Incorrect Authorization

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
3.1	ADP	DECLARED	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
3.1	134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Nodejs	Node.js	All	All	All	All
Application	Nodejs	Node.js	All	All	All	All
Application	Nodejs	Node.js	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	NodeJS	Node	affected 4.0 4.* semver	Not specified
CNA	NodeJS	Node	affected 5.0 5.* semver	Not specified
CNA	NodeJS	Node	affected 6.0 6.* semver	Not specified
CNA	NodeJS	Node	affected 7.0 7.* semver	Not specified
CNA	NodeJS	Node	affected 8.0 8.* semver	Not specified
CNA	NodeJS	Node	affected 9.0 9.* semver	Not specified
CNA	NodeJS	Node	affected 10.0 10.* semver	Not specified
CNA	NodeJS	Node	affected 11.0 11.* semver	Not specified
CNA	NodeJS	Node	affected 12.0 12.* semver	Not specified
CNA	NodeJS	Node	affected 13.0 13.* semver	Not specified
CNA	NodeJS	Node	affected 14.0 14.21.3 semver	Not specified
CNA	NodeJS	Node	affected 15.0 15.* semver	Not specified
CNA	NodeJS	Node	affected 16.0 16.19.1 semver	Not specified
CNA	NodeJS	Node	affected 17.0 17.* semver	Not specified
CNA	NodeJS	Node	affected 18.0 18.14.1 semver	Not specified
CNA	NodeJS	Node	affected 19.0 19.6.1 semver	Not specified

References

Reference	Source	Link	Tags
Februray 2023 Node.js Vulnerabilities in NetApp Products \| NetApp Product Security	af854a3a-2127-422b-91ae-364da2661108	security.netapp.com
Thursday February 16 2023 Security Releases \| Node.js	af854a3a-2127-422b-91ae-364da2661108	nodejs.org	Patch, Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

160533 Oracle Enterprise Linux Security Update for nodejs:18 (ELSA-2023-1583)
160535 Oracle Enterprise Linux Security Update for nodejs:16 (ELSA-2023-1582)
160547 Oracle Enterprise Linux Security Update for nodejs:14 (ELSA-2023-1743)
160639 Oracle Enterprise Linux Security Update for nodejs:18 (ELSA-2023-2654)
160640 Oracle Enterprise Linux Security Update for nodejs and nodejs-nodemon (ELSA-2023-2655)
241304 Red Hat Update for nodejs:14 security (RHSA-2023:1533)
241307 Red Hat Update for nodejs:18 security (RHSA-2023:1583)
241332 Red Hat Update for nodejs:16 security (RHSA-2023:1582)
241341 Red Hat Update for nodejs:14 security (RHSA-2023:1742)
241342 Red Hat Update for nodejs:14 security (RHSA-2023:1743)
241343 Red Hat Update for rh-nodejs14-nodejs security (RHSA-2023:1744)
241429 Red Hat Update for nodejs and nodejs-nodemon security (RHSA-2023:2655)
241457 Red Hat Update for nodejs:18 security (RHSA-2023:2654)
284203 Fedora Security Update for nodejs16 (FEDORA-2023-973319d5b7)
355622 Amazon Linux Security Advisory for nodejs : ALAS2023-2023-243
378467 Alibaba Cloud Linux Security Update for nodejs:14 (ALINUX3-SA-2023:0037)
502669 Alpine Linux Security Update for nodejs
502670 Alpine Linux Security Update for nodejs
502748 Alpine Linux Security Update for nodejs
6000404 Debian Security Update for nodejs (DSA 5589-1)
753755 SUSE Enterprise Linux Security Update for nodejs14 (SUSE-SU-2023:0674-1)
753756 SUSE Enterprise Linux Security Update for nodejs16 (SUSE-SU-2023:0673-1)
905678 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs (13755)
905683 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs (13776)
906613 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs (13776-3)
907123 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs (13755-1)
940976 AlmaLinux Security Update for nodejs:16 (ALSA-2023:1582)
940977 AlmaLinux Security Update for nodejs:18 (ALSA-2023:1583)
940979 AlmaLinux Security Update for nodejs:14 (ALSA-2023:1743)
941013 AlmaLinux Security Update for nodejs and nodejs-nodemon (ALSA-2023:2655)
941014 AlmaLinux Security Update for nodejs:18 (ALSA-2023:2654)
960893 Rocky Linux Security Update for nodejs:18 (RLSA-2023:1583)
960902 Rocky Linux Security Update for nodejs:16 (RLSA-2023:1582)
960917 Rocky Linux Security Update for nodejs:14 (RLSA-2023:1743)
960937 Rocky Linux Security Update for nodejs and nodejs-nodemon (RLSA-2023:2655)