CVE-2023-30581

Published: 11/22/2023 Last updated: 6/5/2025 Reserved: 4/13/2023

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

CNA assigner: hackerone (36234546-b8fa-4601-9d6f-f4e334aa8ea1) Requested by: n/a

Metrics

Version	Score	Severity	Vector String
3.1	7.5	High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Opam packages affected (1)

conf-npm

Products affected (1)

Product	Vendor	Version
Node	NodeJS	< a5ca1be7f9817de4e93085778b3ee2219bdc2664

References (2)

https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
https://nodejs.org/en/blog/vulnerability/june-2023-security-releases