It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-304 advisory.

    The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module.

    Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x. (CVE-2023-32002)

    The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside     of the policy.json definition for a given module.

    Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of     Node.js.

    Impacts:

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x. (CVE-2023-32006)

    The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal     modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the     limits defined in a policy.json file.

    Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

    Impacts

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x. (CVE-2023-32559)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-304)

critical Nessus Plugin ID 180113

Version 1.5