CVE-2023-32006 : The use of `module.constructor.createRequire()` can bypass the policy mechanism

The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

Published 2023-08-15 16:15:11

Updated 2025-05-08 16:15:23

Source HackerOne

View at NVD, CVE.org

Products affected by CVE-2023-32006

Fedoraproject » Fedora » Version: 37
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 38
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
Matching versions
Nodejs » Node.js »
Versions from including (>=) 20.0.0 and up to, including, (<=) 20.5.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Matching versions
Nodejs » Node.js »
Versions from including (>=) 18.0.0 and up to, including, (<=) 18.17.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Matching versions
Nodejs » Node.js »
Versions from including (>=) 16.0.0 and up to, including, (<=) 16.20.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-32006

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 15 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-32006

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	134c704f-9b21-4f2e-91b3-4a467353bcc0	2025-05-08
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-32006

CWE-693 Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

References for CVE-2023-32006

https://security.netapp.com/advisory/ntap-20230915-0009/

August 2023 Node.js Vulnerabilities in NetApp Products | NetApp Product Security

CVEs referencing this url
https://hackerone.com/reports/2043807

Node.js | Report #2043807 - Policy-restricted modules can escalate to higher privileges by impersonating other modules in a policy list using module.constructor.createRequire() | HackerOne
Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/

[SECURITY] Fedora 37 Update: nodejs18-18.17.1-1.fc37 - package-announce - Fedora Mailing-Lists
Mailing List

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/

[SECURITY] Fedora 38 Update: nodejs16-16.20.2-1.fc38 - package-announce - Fedora Mailing-Lists
Mailing List

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2023-32006

Products affected by CVE-2023-32006

Exploit prediction scoring system (EPSS) score for CVE-2023-32006

CVSS scores for CVE-2023-32006

CWE ids for CVE-2023-32006

References for CVE-2023-32006