CVE-2023-30581: High severity ibm planning analytics cloud vulnerability
A vulnerability has been discovered in Node.js, where the use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition.
Other sources
Node.js could allow a remote attacker to bypass security restrictions, caused by the use of proto in process.mainModule.proto.require(). By sending a specially crafted request, an attacker could exploit this vulnerability to bypass experimental policy mechanism.
— IBM
The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js
— MITRE
The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition.
References: https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-30581?
CVE-2023-30581 is a vulnerability that allows the use of __proto__ to bypass the policy mechanism in Node.js.
What is the severity of CVE-2023-30581?
The severity of CVE-2023-30581 is high with a score of 7.5.
What software is affected by CVE-2023-30581?
Node.js versions 16, 18, and 20 are affected by CVE-2023-30581.
How can CVE-2023-30581 be exploited?
CVE-2023-30581 can be exploited by using __proto__ in process.mainModule.__proto__.require() to require modules outside of the policy.json definition.
How can I fix CVE-2023-30581?
To fix CVE-2023-30581, it is recommended to update to the latest version of Node.js or apply the appropriate patches provided by the vendor.