The use of `Module._load()` can bypass the policy...
Critical severity
Unreviewed
Published
Aug 21, 2023
to the GitHub Advisory Database
•
Updated Oct 7, 2024
Description
Published by the National Vulnerability Database
Aug 21, 2023
Published to the GitHub Advisory Database
Aug 21, 2023
Last updated
Oct 7, 2024
The use of
Module._load()
can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
References