CVE-2023-32559

CVE-2023-32559 describes a privilege-escalation vulnerability in Node.js via the experimental policy mechanism. The attack leverages the deprecated API process.binding(), potentially bypassing policy.json and abusing process.binding('spawn_sync') to run arbitrary code outside policy limits. The i...

CVE-2023-32002

CVE-2023-32002 concerns Node.js where the policy mechanism (experimental) can be bypassed via Module._load() , allowing modules outside policy.json. The CVE affects all supported lines using the experimental policy (Node.js 16.x, 18.x, 20.x). Connected advisories confirm affected packages as Node...

CVE-2023-32006

CVE-2023-32006 affects Node.js when using the experimental policy mechanism (supported in 16.x, 18.x, 20.x). The root cause is that module.constructor.createRequire() can bypass policy and load modules outside policy.json. Multiple advisories reference the vulnerability alongside other policy-rel...