Privilege Escalation in Node.js Affecting Multiple Versions

CVE-2023-32559

What is CVE-2023-32559?

An issue has been identified in Node.js that allows privilege escalation through an experimental policy mechanism present in versions 16.x, 18.x, and 20.x. This vulnerability arises from the usage of the deprecated API process.binding(), which can potentially circumvent the policy settings defined in policy.json. By exploiting this flaw, attackers may attain unauthorized access and execute arbitrary code, undermining the intended security constraints of the policy. It's important to note that this policy mechanism is intended as an experimental feature, thus making the vulnerability particularly significant.

References