Maple Labs

CVE search · CVE-2023-32006

CVE-2023-32006

high 8.8

The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
support@hackerone.com
Weakness
NVD-CWE-noinfo, CWE-693

Severity

VersionScoreVectorSource
CVSS 3.1 high 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H nvd@nist.govPrimary
CVSS 3.1 high 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

References