Log in Start free

Vulnerability · Published Oct 18, 2023 · Assigned by hackerone

CVE-2023-39331

High 7.7

In plain English

A high-severity security flaw in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)7.7High
Exploit odds (30 days)1.5%top 25.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8nodejs1:20.8.1-1.module_el8.9.0+3675+0258a6d9ALSA-2023:7205
AlmaLinux:8nodejs-devel1:20.8.1-1.module_el8.9.0+3675+0258a6d9ALSA-2023:7205
AlmaLinux:8nodejs-docs1:20.8.1-1.module_el8.9.0+3675+0258a6d9ALSA-2023:7205
AlmaLinux:8nodejs-full-i18n1:20.8.1-1.module_el8.9.0+3675+0258a6d9ALSA-2023:7205
AlmaLinux:8nodejs-nodemon3.0.1-1.module_el8.9.0+3675+0258a6d9ALSA-2023:7205
AlmaLinux:8nodejs-packaging2021.06-4.module_el8.9.0+3684+11b9e959ALSA-2023:7205
AlmaLinux:8nodejs-packaging-bundler2021.06-4.module_el8.9.0+3684+11b9e959ALSA-2023:7205
AlmaLinux:8npm1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9ALSA-2023:7205
Alpine:v3.20nodejs-current20.8.1-r0ALPINE-CVE-2023-39331
Alpine:v3.21nodejs-current20.8.1-r0ALPINE-CVE-2023-39331
Alpine:v3.22nodejs-current20.8.1-r0ALPINE-CVE-2023-39331
Alpine:v3.23nodejs-current20.8.1-r0ALPINE-CVE-2023-39331
Alpine:v3.24nodejs-current20.8.1-r0ALPINE-CVE-2023-39331
Rocky Linux:8nodejs-nodemon0:3.0.1-1.module+el8.8.0+1459+02651ab6RLSA-2023:7205
Rocky Linux:8nodejs-packaging0:2021.06-4.module+el8.7.0+1072+5b168780RLSA-2023:7205

Affected products (as reported)

VendorProductVersions
NodeJS Node 4.0 – before 4.*5.0 – before 5.*6.0 – before 6.*7.0 – before 7.*8.0 – before 8.*9.0 – before 9.*10.0 – before 10.*11.0 – before 11.*

References