CVE-2023-39333

MEDIUM

Node.js < 18.18.2, 20.x < 20.8.1 - JavaScript Code Injection via WebAssembly Export Names

Title source: llm
STIX 2.1

Description

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.

References (4)

Core 4

Scores

CVSS v3 5.3
EPSS 0.0009
EPSS Percentile 26.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-94
Status published
Products (17)
NodeJS/Node 10.0 - 10.*
NodeJS/Node 11.0 - 11.*
NodeJS/Node 12.0 - 12.*
NodeJS/Node 13.0 - 13.*
NodeJS/Node 14.0 - 14.*
NodeJS/Node 15.0 - 15.*
NodeJS/Node 16.0 - 16.*
NodeJS/Node 17.0 - 17.*
NodeJS/Node 18.0 - 18.18.2
NodeJS/Node 19.0 - 19.*
... and 7 more
Published Sep 07, 2024
Tracked Since Feb 18, 2026