CVE-2023-32002

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-32002
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-32002.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-32002
Aliases
Downstream
ALPINE (1)
AZL (2)
BELL (1)
CGA (6)
CLEANSTART (2)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (1)
RHSA (6)
RLSA (4)
SUSE (8)
UBUNTU (1)
Related
ALSA (4)
CGA (1)
openSUSE (1)
SUSE (8)
Published
2023-08-21T16:52:42Z
Modified
2026-08-12T03:51:12Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.

This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.

Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

Database specific 
{
    "cna_assigner":  "hackerone",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32002.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "4.0"
                },
                {
                    "fixed":  "4.*"
                },
                {
                    "introduced":  "5.0"
                },
                {
                    "fixed":  "5.*"
                },
                {
                    "introduced":  "6.0"
                },
                {
                    "fixed":  "6.*"
                },
                {
                    "introduced":  "7.0"
                },
                {
                    "fixed":  "7.*"
                },
                {
                    "introduced":  "8.0"
                },
                {
                    "fixed":  "8.*"
                },
                {
                    "introduced":  "9.0"
                },
                {
                    "fixed":  "9.*"
                },
                {
                    "introduced":  "10.0"
                },
                {
                    "fixed":  "10.*"
                },
                {
                    "introduced":  "11.0"
                },
                {
                    "fixed":  "11.*"
                },
                {
                    "introduced":  "12.0"
                },
                {
                    "fixed":  "12.*"
                },
                {
                    "introduced":  "13.0"
                },
                {
                    "fixed":  "13.*"
                },
                {
                    "introduced":  "14.0"
                },
                {
                    "fixed":  "14.*"
                },
                {
                    "introduced":  "15.0"
                },
                {
                    "fixed":  "15.*"
                },
                {
                    "introduced":  "16.0"
                },
                {
                    "fixed":  "16.20.2"
                },
                {
                    "introduced":  "17.0"
                },
                {
                    "fixed":  "17.*"
                },
                {
                    "introduced":  "18.0"
                },
                {
                    "fixed":  "18.17.1"
                },
                {
                    "introduced":  "19.0"
                },
                {
                    "fixed":  "19.*"
                },
                {
                    "introduced":  "20.0"
                },
                {
                    "fixed":  "20.5.1"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/nodejs/node

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/node
Events
Introduced
7162e686b18d22b4385fa5c04274fb04dbd810c7
Last Affected
b53c51995380b1f8d642297d848cab6010d2909c
Introduced
49a77a5a996a49e8cb728eed42e55a7c1a9eef6e
Last Affected
a39b8a2a3e8414c8a54650bdfe4a46998282d88a
Introduced
e7618fb5a5fc25d76b6474e2a6607f04fd6f10e0
Last Affected
f13c7f5008ecbd166e6aba6702dfa84da1863ece
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "16.0.0"
        },
        {
            "last_affected":  "16.20.1"
        },
        {
            "introduced":  "18.0.0"
        },
        {
            "last_affected":  "18.17.0"
        },
        {
            "introduced":  "20.0.0"
        },
        {
            "last_affected":  "20.5.0"
        }
    ],
    "source":  "CPE_RANGE"
}

Affected versions

v16.*
v16.0.0
v16.1.0
v16.10.0
v16.11.0
v16.11.1
v16.12.0
v16.13.0
v16.13.1
v16.13.2
v16.14.0
v16.14.1
v16.14.2
v16.15.0
v16.15.1
v16.16.0
v16.17.0
v16.17.1
v16.18.0
v16.18.1
v16.19.0
v16.19.1
v16.2.0
v16.20.0
v16.20.1
v16.3.0
v16.4.0
v16.4.1
v16.4.2
v16.5.0
v16.6.0
v16.6.1
v16.6.2
v16.7.0
v16.8.0
v16.9.0
v16.9.1
v18.*
v18.0.0
v18.1.0
v18.10.0
v18.11.0
v18.12.0
v18.12.1
v18.13.0
v18.14.0
v18.14.1
v18.14.2
v18.15.0
v18.16.0
v18.16.1
v18.17.0
v18.2.0
v18.3.0
v18.4.0
v18.5.0
v18.6.0
v18.7.0
v18.8.0
v18.9.0
v18.9.1
v20.*
v20.0.0
v20.1.0
v20.2.0
v20.3.0
v20.3.1
v20.4.0
v20.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-32002.json"