CVE-2023-30581 | BDVDB-2026-217566 Detail

Description#

The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12023-11-22Record published in the CVE List.
2. Version 22025-11-03Most recent update recorded in the CVE List.