CVE-2023-32558

7.5

HIGHCVSS v3

Published

September 12, 2023

Affected

10 projects

Assigned by

[email protected]

Severity scale

010

Description

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

@externs/nodejs

NPMThe Closure Compiler Externs For Node.JS.

= *, >= 20.0.0, < 20.5.1NVD

externs/nodejs

GitHubThe Externs For Node.JS.

= *, >= 20.0.0, < 20.5.1NVD

@depack/nodejs

NPM

More on this CVE

NVD↗GitHub Advisory↗

Mocks Of Built-In Node.JS Modules To Use For Compilation.

= *, >= 20.0.0, < 20.5.1NVD

@opencensus/nodejs

NPMOpenCensus is a toolkit for collecting application performance and behavior data.

= *, >= 20.0.0, < 20.5.1NVD

dpck/nodejs

GitHubMocks Of Built-In Node.JS Modules To Use For Compilation.

= *, >= 20.0.0, < 20.5.1NVD

nodejs

Python Package IndexPython bindings and utils for Node.js and io.js

= *, >= 20.0.0, < 20.5.1NVD

nodejs

NPM

= *, >= 20.0.0, < 20.5.1NVD

nodejs

Crates.ioEmbedding Node.js in Rust

= *, >= 20.0.0, < 20.5.1NVD

node.js

NPMsecurity holding package

= *, >= 20.0.0, < 20.5.1NVD

Node.js

NuGet GalleryNode.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js' package ecosystem, npm, is the largest ecosystem of open source libraries in the world.

= *, >= 20.0.0, < 20.5.1NVD

Security Advisories

CVE-2023-32558

Description

More on this CVE