Node.js version 20 vulnerability allows bypassing restrictions through inspector module

CVE-2023-30587

What is CVE-2023-30587?

A security vulnerability in Node.js 20 allows attackers to bypass permission restrictions established by the --experimental-permission flag through the inspector module (node:inspector). This vulnerability arises from the Worker class's capability to create an 'internal worker' utilizing the kIsInternal Symbol. By modifying the isInternal value during the initialization phase when the inspector is attached to the Worker constructor, an attacker can successfully circumvent the intended permission settings. This issue particularly impacts Node.js users who are utilizing the experimental permission model, underscoring the risks associated with transitioning features in early testing phases.

References