Node.js Vulnerability in Windows Installer for Node.js by OpenJS Foundation

CVE-2023-30585

What is CVE-2023-30585?

A vulnerability exists in the Node.js .msi installer for Windows that allows unprivileged users to manipulate the %USERPROFILE% environment variable. During a repair operation, the 'msiexec.exe' process attempts to read this variable's path from the registry. If the path does not exist, it unwittingly creates folders in arbitrary locations, which could be exploited by malicious entities. This issue emphasizes the risks associated with the environment variable management in Windows systems, specifically affecting users who install Node.js via the .msi method.

References