import-in-the-middle allows unsanitized user controlled input in module generation

CVE-2023-38704

What is CVE-2023-38704?

The import-in-the-middle module from DataDog is vulnerable to a remote code execution exploit due to improper handling of user-supplied input in the import() function. This issue arises from its method of generating a wrapper module that loads the original module, which can be manipulated when an application directly passes unverified user inputs. The vulnerability has been fixed in version 1.4.2, and users are advised to refrain from using dynamic imports with user inputs. Instead, valid input should be strictly checked against an established whitelist. If the use of ESM modules is unnecessary, ensure that no loader hooks are enabled by adjusting command-line options or the NODE_OPTIONS environment variable.

References