CVE-2023-23918

Details

A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.

Affected Packages

Node.js

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1809) / Server 2019Windows 10 (1903)Windows 10 (1909)

Fixed in:

14.21.316.19.118.14.119.6.1

References

WEB

https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/

WEB

https://security.netapp.com/advisory/ntap-20230316-0008/

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2023-23918