BIT-node-min-2023-23918
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/node-min/BIT-node-min-2023-23918.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-node-min-2023-23918
- Aliases
- Published
- 2024-12-16T14:00:44.833Z
- Modified
- 2024-12-16T15:26:52.476419Z
- Summary
- [none]
- Details
-
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
- Database specific
{ "cpes": [ "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*" ], "severity": "High" }- References
Affected packages
Bitnami / node-min
Package
- Name
- node-min
- Purl
- pkg:bitnami/node-min
Severity
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator