CVE-2023-30581

CWE-862 — Missing Authorization6 documents6 sources
Severity
7.5HIGH
EPSS
0.0%
top 95.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nodejs NodeNodejs Node.js
Timeline
PublishedNov 23

Description

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5nodejs/node4.0 — 4.*+16
▶NVDnodejs/node.js16.0.0 — 16.20.1+2
▶Debiannodejs< 18.19.0+dfsg-6~deb12u1+2

🔴Vulnerability Details

3
OSV
CVE-2023-30581: The use of __proto__ in process↗2023-11-23
▶
GHSA
GHSA-86v4-9wq7-fx97: The use of __proto__ in process↗2023-11-23
▶
CVEList
CVE-2023-30581: The use of __proto__ in process↗2023-11-22
▶

📋Vendor Advisories

2
Red Hat
nodejs: mainModule.proto bypass experimental policy mechanism↗2023-06-20
▶
Debian
CVE-2023-30581: nodejs - The use of __proto__ in process.mainModule.__proto__.require() can bypass the po...↗2023
▶
CVE-2023-30581 (HIGH CVSS 7.5) | The use of __proto__ in process.mai | cvebase.io