The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x 18.x and 20.x. Please note that at the time this CVE was issued the policy is an experimental feature of Node.js.

🗓️ 21 Aug 2023 07:00:00Reported by MicrosoftType

mscve

mscve🔗 msrc.microsoft.com👁 5 Views

Module.constructor.createRequire bypasses policy.json, enabling loads outside policy in experimental.

Reporter	Title	Published	Views	Family All 209
IBM Security Bulletins	Security Bulletin: IBM Event Streams is affected by a vulnerability in Node.js (CVE-2023-32006)	29 Nov 202322:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 9.0.1	16 Nov 202315:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple Node.js vulnerabilities	31 Jan 202413:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data 4.8.0 has addressed security vulnerabilities	29 Nov 202322:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js and packaged modules affect IBM Business Automation Workflow Configuration Editor	26 Sep 202308:26	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	5 Feb 202415:13	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.11 addresses multiple security vulnerabilities.	20 Dec 202316:10	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to bypassing security restrictions due to multiple Node.js vulnerabilities	14 Sep 202317:19	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM Voice Gateway	2 Oct 202320:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.13 and earlier	12 Oct 202319:11	–	ibm

Vulners

Node

OR

microsoft cbl2_nodejs18_18.17.1-2Range<18.17.1-2

microsoft cbl2_nodejs_16.20.2-2Range<16.20.2-2

22 Aug 2023 07:00Current

7.4High risk

Vulners AI Score7.4

CVSS 3.18.8

EPSS0.01544

SSVC

module loading bypass policy.json bypass experimental policy feature