Node.js: Policy-restricted modules can escalate to higher privileges by impersonating other modules in a policy list using module.constructor.createRequire()

Vulners
Hackerone
Node.js: Policy-restricted modules can escalate to higher privileges by impersonating other modules in a policy list using module.constructor.createRequire()

2023-06-3006:09:36

haxatron1

hackerone.com

node.js

policy-restricted

module escalation

createrequire()

vulnerability

policy mechanism

cve

experimental feature

bug bounty

0.001 Low

EPSS

Percentile

29.3%

JSON

The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.

This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.

Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

redhatcve 1

alpinelinux 1

ibm 16

ubuntucve 1

cve 1

veracode 1

hackerone 1

cbl_mariner 2

osv 10

nvd 1