High severity · published Sep 12, 2023
CVE-2023-32558
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal
7.5
CVSS
1.7%
EPSS
No
On KEV
Description
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal.
This vulnerability affects all users using the experimental permission model in Node.js 20.x.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Node.js · Nodejs
20.0.0 before 20.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-32558
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-32558
Exploit
https://hackerone.com/reports/2051257
security.netapp.com
https://security.netapp.com/advisory/ntap-20241025-0003/
More from Node.js
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2026-21636
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled
9.8
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
9.8
CVE-2024-3566
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific…
9.8
CVE-2024-21896
The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user