An untrusted search path vulnerability exists in Node.js. (CVE-2023-23920)

Original description

The description as published by the source.

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami node-min

[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.21.3"},{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.6.1"}]}]

Bitnami node

[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.21.3"},{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.6.1"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2023-23920 nodejs Fixed in: 14.21.3-r0
Debian DEBIAN-CVE-2023-23920 nodejs Fixed in: 12.22.12~dfsg-1~deb11u4

References

advisory security.netapp.com
advisory debian.org
advisory nvd.nist.gov
advisory github.com
web lists.debian.org
web nodejs.org