A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published: 2023-02-23T00:00:00

Updated: 2024-08-02T10:42:27.095Z

Reserved: 2023-01-19T00:00:00

Link: CVE-2023-23918

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-02-23T20:15:13.920

Modified: 2024-11-21T07:47:05.923

Link: CVE-2023-23918

cve-icon Redhat

Severity : Moderate

Publid Date: 2023-02-16T00:00:00Z

Links: CVE-2023-23918 - Bugzilla