Lucene search

K
alpinelinuxAlpine Linux Development TeamALPINE:CVE-2023-30581
HistoryNov 23, 2023 - 12:15 a.m.

CVE-2023-30581

2023-11-2300:15:07
Alpine Linux Development Team
security.alpinelinux.org
10
node.js
cve-2023-30581
policy bypass

6.8 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

20.9%

The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.

Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

OSVersionArchitecturePackageVersionFilename
Alpine3.16-mainnoarchnodejs= 16.20.2-r0UNKNOWN
Alpine3.15-mainnoarchnodejs= 16.20.2-r0UNKNOWN
Alpine3.18-mainnoarchnodejs= 18.20.1-r0UNKNOWN
Alpine3.17-mainnoarchnodejs= 18.20.1-r0UNKNOWN