CVE-2023-30581
HIGHNode.js 16.0.0-16.20.1 - Authorization Bypass via __proto__ in process.mainModule
Title source: llmDescription
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js
References (2)
Core 2
Core References
Vendor Advisory
https://security.netapp.com/advisory/ntap-20241101-0011/
Scores
CVSS v3
7.5
EPSS
0.0002
EPSS Percentile
5.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-862
Status
published
Products (1)
nodejs/node.js
16.0.0 - 16.20.1
Published
Nov 23, 2023
Tracked Since
Feb 18, 2026