Medium severity · published Sep 7, 2024
CVE-2023-39333
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code
5.3
CVSS
1.1%
EPSS
No
On KEV
Description
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.
This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Node · NodeJS
4.0 before 4.*; 5.0 before 5.*; 6.0 before 6.*; 7.0 before 7.*; 8.0 before 8.*; 9.0 before 9.*; +11 more · source: vendor
NO
Nodejs · Nodejs
18.0 before 18.18.2; 20.0 before 20.8.1 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-39333
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-39333
nodejs.org
https://nodejs.org/en/blog/vulnerability/october-2023-security-releases
security.netapp.com
https://security.netapp.com/advisory/ntap-20240808-0004/
security.netapp.com
https://security.netapp.com/advisory/ntap-20241004-0006/
security.netapp.com
https://security.netapp.com/advisory/ntap-20241108-0002/
More from Node
10.0
CVE-2026-21636
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled
9.8
CVE-2026-48930
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings
9.1
CVE-2025-55130
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths
8.4
CVE-2026-58043
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries
8.2
CVE-2026-48617
A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation