A privilege escalation vulnerability exists in Node.js (CVE-2023-23918)

Original description

The description as published by the source.

A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami node-min

[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.21.3"},{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.6.1"}]}]

Bitnami node

[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.21.3"},{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.6.1"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2023-23918 nodejs Fixed in: 14.21.3-r0
Debian DEBIAN-CVE-2023-23918 nodejs Fixed in: 18.19.0+dfsg-6~deb12u1

References

advisory security.netapp.com
advisory nvd.nist.gov
advisory github.com
web nodejs.org