ALPINE-CVE-2023-23920

See a problem?
Please try reporting it to the source first.
Source
https://security.alpinelinux.org/vuln/CVE-2023-23920
Import Source
https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-23920.json
JSON Data
https://api.osv.dev/v1/vulns/ALPINE-CVE-2023-23920
Upstream
Published
2023-02-23T20:15:14.047Z
Modified
2025-12-03T22:52:00.086286Z
Severity
  • 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.

References

Affected packages

Alpine:v3.14

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
14.21.3-r0

Affected versions

4.*

4.4.3-r0
4.4.4-r0
4.4.5-r0
4.4.7-r0
4.5.0-r0

6.*

6.9.1-r0
6.9.1-r1
6.9.2-r0
6.9.4-r0
6.9.4-r1
6.9.5-r0
6.9.5-r1
6.10.0-r0
6.10.1-r0
6.10.3-r0
6.11.0-r0
6.11.1-r0
6.11.1-r1
6.11.1-r2
6.11.2-r0
6.11.3-r0
6.11.4-r0
6.11.5-r0

8.*

8.9.0-r0
8.9.1-r0
8.9.2-r0
8.9.3-r0
8.9.3-r1
8.9.4-r0
8.10.0-r0
8.11.0-r0
8.11.0-r1
8.11.1-r0
8.11.1-r1
8.11.1-r2
8.11.2-r0
8.11.3-r0
8.11.3-r1
8.11.3-r2
8.11.3-r3
8.11.4-r0
8.12.0-r0

10.*

10.13.0-r0
10.14.0-r0
10.14.1-r0
10.14.2-r0
10.15.1-r0
10.15.3-r0
10.16.0-r0
10.16.1-r0
10.16.2-r0
10.16.3-r0

12.*

12.13.0-r0
12.13.0-r1
12.13.1-r0
12.14.0-r0
12.14.1-r0
12.15.0-r0
12.15.0-r1
12.15.0-r2
12.16.2-r0
12.16.3-r0
12.16.3-r1
12.17.0-r0
12.18.0-r0
12.18.0-r1
12.18.0-r2
12.18.2-r0
12.18.3-r0
12.18.4-r0
12.19.0-r0

14.*

14.15.1-r0
14.15.3-r0
14.15.3-r1
14.15.3-r2
14.15.4-r0
14.15.5-r0
14.16.0-r0
14.16.0-r1
14.16.1-r0
14.16.1-r1
14.16.1-r2
14.17.0-r0
14.17.1-r0
14.17.3-r0
14.17.4-r0
14.17.5-r0
14.17.6-r0
14.18.1-r0
14.19.0-r0
14.20.0-r0
14.20.1-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-23920.json"

Alpine:v3.15

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
16.19.1-r0

Affected versions

4.*

4.4.3-r0
4.4.4-r0
4.4.5-r0
4.4.7-r0
4.5.0-r0

6.*

6.9.1-r0
6.9.1-r1
6.9.2-r0
6.9.4-r0
6.9.4-r1
6.9.5-r0
6.9.5-r1
6.10.0-r0
6.10.1-r0
6.10.3-r0
6.11.0-r0
6.11.1-r0
6.11.1-r1
6.11.1-r2
6.11.2-r0
6.11.3-r0
6.11.4-r0
6.11.5-r0

8.*

8.9.0-r0
8.9.1-r0
8.9.2-r0
8.9.3-r0
8.9.3-r1
8.9.4-r0
8.10.0-r0
8.11.0-r0
8.11.0-r1
8.11.1-r0
8.11.1-r1
8.11.1-r2
8.11.2-r0
8.11.3-r0
8.11.3-r1
8.11.3-r2
8.11.3-r3
8.11.4-r0
8.12.0-r0

10.*

10.13.0-r0
10.14.0-r0
10.14.1-r0
10.14.2-r0
10.15.1-r0
10.15.3-r0
10.16.0-r0
10.16.1-r0
10.16.2-r0
10.16.3-r0

12.*

12.13.0-r0
12.13.0-r1
12.13.1-r0
12.14.0-r0
12.14.1-r0
12.15.0-r0
12.15.0-r1
12.15.0-r2
12.16.2-r0
12.16.3-r0
12.16.3-r1
12.17.0-r0
12.18.0-r0
12.18.0-r1
12.18.0-r2
12.18.2-r0
12.18.3-r0
12.18.4-r0
12.19.0-r0

14.*

14.15.1-r0
14.15.3-r0
14.15.3-r1
14.15.3-r2
14.15.4-r0
14.15.5-r0
14.16.0-r0
14.16.0-r1
14.16.1-r0
14.16.1-r1
14.16.1-r2
14.17.0-r0
14.17.1-r0
14.17.2-r0
14.17.3-r0
14.17.4-r0
14.17.5-r0
14.17.6-r0
14.17.6-r1
14.18.0-r0
14.18.1-r0
14.18.1-r1

16.*

16.13.0-r0
16.13.1-r0
16.13.2-r0
16.14.0-r0
16.14.2-r0
16.16.0-r0
16.17.1-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-23920.json"

Alpine:v3.16

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
16.19.1-r0

Affected versions

4.*

4.4.3-r0
4.4.4-r0
4.4.5-r0
4.4.7-r0
4.5.0-r0

6.*

6.9.1-r0
6.9.1-r1
6.9.2-r0
6.9.4-r0
6.9.4-r1
6.9.5-r0
6.9.5-r1
6.10.0-r0
6.10.1-r0
6.10.3-r0
6.11.0-r0
6.11.1-r0
6.11.1-r1
6.11.1-r2
6.11.2-r0
6.11.3-r0
6.11.4-r0
6.11.5-r0

8.*

8.9.0-r0
8.9.1-r0
8.9.2-r0
8.9.3-r0
8.9.3-r1
8.9.4-r0
8.10.0-r0
8.11.0-r0
8.11.0-r1
8.11.1-r0
8.11.1-r1
8.11.1-r2
8.11.2-r0
8.11.3-r0
8.11.3-r1
8.11.3-r2
8.11.3-r3
8.11.4-r0
8.12.0-r0

10.*

10.13.0-r0
10.14.0-r0
10.14.1-r0
10.14.2-r0
10.15.1-r0
10.15.3-r0
10.16.0-r0
10.16.1-r0
10.16.2-r0
10.16.3-r0

12.*

12.13.0-r0
12.13.0-r1
12.13.1-r0
12.14.0-r0
12.14.1-r0
12.15.0-r0
12.15.0-r1
12.15.0-r2
12.16.2-r0
12.16.3-r0
12.16.3-r1
12.17.0-r0
12.18.0-r0
12.18.0-r1
12.18.0-r2
12.18.2-r0
12.18.3-r0
12.18.4-r0
12.19.0-r0

14.*

14.15.1-r0
14.15.3-r0
14.15.3-r1
14.15.3-r2
14.15.4-r0
14.15.5-r0
14.16.0-r0
14.16.0-r1
14.16.1-r0
14.16.1-r1
14.16.1-r2
14.17.0-r0
14.17.1-r0
14.17.2-r0
14.17.3-r0
14.17.4-r0
14.17.5-r0
14.17.6-r0
14.17.6-r1
14.18.0-r0
14.18.1-r0
14.18.1-r1

16.*

16.13.0-r0
16.13.1-r0
16.13.1-r1
16.13.2-r0
16.13.2-r1
16.14.2-r0
16.14.2-r1
16.15.0-r0
16.15.0-r1
16.16.0-r0
16.17.1-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-23920.json"

Alpine:v3.17

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.14.1-r0

Affected versions

4.*

4.4.3-r0
4.4.4-r0
4.4.5-r0
4.4.7-r0
4.5.0-r0

6.*

6.9.1-r0
6.9.1-r1
6.9.2-r0
6.9.4-r0
6.9.4-r1
6.9.5-r0
6.9.5-r1
6.10.0-r0
6.10.1-r0
6.10.3-r0
6.11.0-r0
6.11.1-r0
6.11.1-r1
6.11.1-r2
6.11.2-r0
6.11.3-r0
6.11.4-r0
6.11.5-r0

8.*

8.9.0-r0
8.9.1-r0
8.9.2-r0
8.9.3-r0
8.9.3-r1
8.9.4-r0
8.10.0-r0
8.11.0-r0
8.11.0-r1
8.11.1-r0
8.11.1-r1
8.11.1-r2
8.11.2-r0
8.11.3-r0
8.11.3-r1
8.11.3-r2
8.11.3-r3
8.11.4-r0
8.12.0-r0

10.*

10.13.0-r0
10.14.0-r0
10.14.1-r0
10.14.2-r0
10.15.1-r0
10.15.3-r0
10.16.0-r0
10.16.1-r0
10.16.2-r0
10.16.3-r0

12.*

12.13.0-r0
12.13.0-r1
12.13.1-r0
12.14.0-r0
12.14.1-r0
12.15.0-r0
12.15.0-r1
12.15.0-r2
12.16.2-r0
12.16.3-r0
12.16.3-r1
12.17.0-r0
12.18.0-r0
12.18.0-r1
12.18.0-r2
12.18.2-r0
12.18.3-r0
12.18.4-r0
12.19.0-r0

14.*

14.15.1-r0
14.15.3-r0
14.15.3-r1
14.15.3-r2
14.15.4-r0
14.15.5-r0
14.16.0-r0
14.16.0-r1
14.16.1-r0
14.16.1-r1
14.16.1-r2
14.17.0-r0
14.17.1-r0
14.17.2-r0
14.17.3-r0
14.17.4-r0
14.17.5-r0
14.17.6-r0
14.17.6-r1
14.18.0-r0
14.18.1-r0
14.18.1-r1

16.*

16.13.0-r0
16.13.1-r0
16.13.1-r1
16.13.2-r0
16.13.2-r1
16.14.2-r0
16.14.2-r1
16.15.0-r0
16.15.0-r1
16.16.0-r0
16.16.0-r1
16.17.0-r0
16.17.1-r0
16.18.0-r0
16.18.0-r1

18.*

18.12.0-r0
18.12.1-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-23920.json"

Alpine:v3.18

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.14.1-r0

Affected versions

4.*

4.4.3-r0
4.4.4-r0
4.4.5-r0
4.4.7-r0
4.5.0-r0

6.*

6.9.1-r0
6.9.1-r1
6.9.2-r0
6.9.4-r0
6.9.4-r1
6.9.5-r0
6.9.5-r1
6.10.0-r0
6.10.1-r0
6.10.3-r0
6.11.0-r0
6.11.1-r0
6.11.1-r1
6.11.1-r2
6.11.2-r0
6.11.3-r0
6.11.4-r0
6.11.5-r0

8.*

8.9.0-r0
8.9.1-r0
8.9.2-r0
8.9.3-r0
8.9.3-r1
8.9.4-r0
8.10.0-r0
8.11.0-r0
8.11.0-r1
8.11.1-r0
8.11.1-r1
8.11.1-r2
8.11.2-r0
8.11.3-r0
8.11.3-r1
8.11.3-r2
8.11.3-r3
8.11.4-r0
8.12.0-r0

10.*

10.13.0-r0
10.14.0-r0
10.14.1-r0
10.14.2-r0
10.15.1-r0
10.15.3-r0
10.16.0-r0
10.16.1-r0
10.16.2-r0
10.16.3-r0

12.*

12.13.0-r0
12.13.0-r1
12.13.1-r0
12.14.0-r0
12.14.1-r0
12.15.0-r0
12.15.0-r1
12.15.0-r2
12.16.2-r0
12.16.3-r0
12.16.3-r1
12.17.0-r0
12.18.0-r0
12.18.0-r1
12.18.0-r2
12.18.2-r0
12.18.3-r0
12.18.4-r0
12.19.0-r0

14.*

14.15.1-r0
14.15.3-r0
14.15.3-r1
14.15.3-r2
14.15.4-r0
14.15.5-r0
14.16.0-r0
14.16.0-r1
14.16.1-r0
14.16.1-r1
14.16.1-r2
14.17.0-r0
14.17.1-r0
14.17.2-r0
14.17.3-r0
14.17.4-r0
14.17.5-r0
14.17.6-r0
14.17.6-r1
14.18.0-r0
14.18.1-r0
14.18.1-r1

16.*

16.13.0-r0
16.13.1-r0
16.13.1-r1
16.13.2-r0
16.13.2-r1
16.14.2-r0
16.14.2-r1
16.15.0-r0
16.15.0-r1
16.16.0-r0
16.16.0-r1
16.17.0-r0
16.17.1-r0
16.18.0-r0
16.18.0-r1

18.*

18.12.0-r0
18.12.1-r0
18.13.0-r0
18.14.0-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-23920.json"

Alpine:v3.19

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.14.1-r0

Affected versions

4.*

4.4.3-r0
4.4.4-r0
4.4.5-r0
4.4.7-r0
4.5.0-r0

6.*

6.9.1-r0
6.9.1-r1
6.9.2-r0
6.9.4-r0
6.9.4-r1
6.9.5-r0
6.9.5-r1
6.10.0-r0
6.10.1-r0
6.10.3-r0
6.11.0-r0
6.11.1-r0
6.11.1-r1
6.11.1-r2
6.11.2-r0
6.11.3-r0
6.11.4-r0
6.11.5-r0

8.*

8.9.0-r0
8.9.1-r0
8.9.2-r0
8.9.3-r0
8.9.3-r1
8.9.4-r0
8.10.0-r0
8.11.0-r0
8.11.0-r1
8.11.1-r0
8.11.1-r1
8.11.1-r2
8.11.2-r0
8.11.3-r0
8.11.3-r1
8.11.3-r2
8.11.3-r3
8.11.4-r0
8.12.0-r0

10.*

10.13.0-r0
10.14.0-r0
10.14.1-r0
10.14.2-r0
10.15.1-r0
10.15.3-r0
10.16.0-r0
10.16.1-r0
10.16.2-r0
10.16.3-r0

12.*

12.13.0-r0
12.13.0-r1
12.13.1-r0
12.14.0-r0
12.14.1-r0
12.15.0-r0
12.15.0-r1
12.15.0-r2
12.16.2-r0
12.16.3-r0
12.16.3-r1
12.17.0-r0
12.18.0-r0
12.18.0-r1
12.18.0-r2
12.18.2-r0
12.18.3-r0
12.18.4-r0
12.19.0-r0

14.*

14.15.1-r0
14.15.3-r0
14.15.3-r1
14.15.3-r2
14.15.4-r0
14.15.5-r0
14.16.0-r0
14.16.0-r1
14.16.1-r0
14.16.1-r1
14.16.1-r2
14.17.0-r0
14.17.1-r0
14.17.2-r0
14.17.3-r0
14.17.4-r0
14.17.5-r0
14.17.6-r0
14.17.6-r1
14.18.0-r0
14.18.1-r0
14.18.1-r1

16.*

16.13.0-r0
16.13.1-r0
16.13.1-r1
16.13.2-r0
16.13.2-r1
16.14.2-r0
16.14.2-r1
16.15.0-r0
16.15.0-r1
16.16.0-r0
16.16.0-r1
16.17.0-r0
16.17.1-r0
16.18.0-r0
16.18.0-r1

18.*

18.12.0-r0
18.12.1-r0
18.13.0-r0
18.14.0-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-23920.json"

Alpine:v3.20

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.14.1-r0

Affected versions

4.*

4.4.3-r0
4.4.4-r0
4.4.5-r0
4.4.7-r0
4.5.0-r0

6.*

6.9.1-r0
6.9.1-r1
6.9.2-r0
6.9.4-r0
6.9.4-r1
6.9.5-r0
6.9.5-r1
6.10.0-r0
6.10.1-r0
6.10.3-r0
6.11.0-r0
6.11.1-r0
6.11.1-r1
6.11.1-r2
6.11.2-r0
6.11.3-r0
6.11.4-r0
6.11.5-r0

8.*

8.9.0-r0
8.9.1-r0
8.9.2-r0
8.9.3-r0
8.9.3-r1
8.9.4-r0
8.10.0-r0
8.11.0-r0
8.11.0-r1
8.11.1-r0
8.11.1-r1
8.11.1-r2
8.11.2-r0
8.11.3-r0
8.11.3-r1
8.11.3-r2
8.11.3-r3
8.11.4-r0
8.12.0-r0

10.*

10.13.0-r0
10.14.0-r0
10.14.1-r0
10.14.2-r0
10.15.1-r0
10.15.3-r0
10.16.0-r0
10.16.1-r0
10.16.2-r0
10.16.3-r0

12.*

12.13.0-r0
12.13.0-r1
12.13.1-r0
12.14.0-r0
12.14.1-r0
12.15.0-r0
12.15.0-r1
12.15.0-r2
12.16.2-r0
12.16.3-r0
12.16.3-r1
12.17.0-r0
12.18.0-r0
12.18.0-r1
12.18.0-r2
12.18.2-r0
12.18.3-r0
12.18.4-r0
12.19.0-r0

14.*

14.15.1-r0
14.15.3-r0
14.15.3-r1
14.15.3-r2
14.15.4-r0
14.15.5-r0
14.16.0-r0
14.16.0-r1
14.16.1-r0
14.16.1-r1
14.16.1-r2
14.17.0-r0
14.17.1-r0
14.17.2-r0
14.17.3-r0
14.17.4-r0
14.17.5-r0
14.17.6-r0
14.17.6-r1
14.18.0-r0
14.18.1-r0
14.18.1-r1

16.*

16.13.0-r0
16.13.1-r0
16.13.1-r1
16.13.2-r0
16.13.2-r1
16.14.2-r0
16.14.2-r1
16.15.0-r0
16.15.0-r1
16.16.0-r0
16.16.0-r1
16.17.0-r0
16.17.1-r0
16.18.0-r0
16.18.0-r1

18.*

18.12.0-r0
18.12.1-r0
18.13.0-r0
18.14.0-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-23920.json"

Alpine:v3.21

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.14.1-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-23920.json"

Alpine:v3.22

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.14.1-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-23920.json"

Alpine:v3.23

nodejs

Package

Name
nodejs
Purl
pkg:apk/alpine/nodejs?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.14.1-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-23920.json"