Maliciously crafted WebAssembly module can inject JavaScript code, potentially exposing sensitive data

CVE-2023-39333

What is CVE-2023-39333?

A security vulnerability in Node.js allows for the injection of malicious JavaScript code through improperly handled exported names in imported WebAssembly modules. When Node.js is initiated with the --experimental-wasm-modules command line option, this vulnerability can be exploited, enabling the injected code to access sensitive data and functionalities that are otherwise restricted. This can lead to unauthorized actions and data exposure, posing a significant risk to applications utilizing affected versions of Node.js.

References