CVE-2023-23918
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-23918?
CVE-2023-23918 is a privilege escalation vulnerability in Node.js versions <19.6.1, <18.14.1, <16.19.1, and <14.21.3.
How can this vulnerability be exploited?
This vulnerability allows an attacker to bypass the experimental Permissions feature in Node.js and access unauthorized modules by using process.mainModule.require().
What is the severity level of CVE-2023-23918?
CVE-2023-23918 has a severity level of high.
How can I fix CVE-2023-23918?
To fix CVE-2023-23918, you need to update your Node.js version to 19.6.1 or higher, 18.14.1 or higher, 16.19.1 or higher, or 14.21.3 or higher.
Where can I find more information about CVE-2023-23918?
You can find more information about CVE-2023-23918 on the Red Hat Bugzilla website, using the following links: [link1], [link2], [link3].