{
  "threat_severity" : "Important",
  "public_date" : "2023-06-20T00:00:00Z",
  "bugzilla" : {
    "description" : "nodejs: mainModule.proto bypass experimental policy mechanism",
    "id" : "2219824",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2219824"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
    "status" : "verified"
  },
  "details" : [ "The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.\nPlease note that at the time this CVE was issued, the policy is an experimental feature of Node.js", "A vulnerability has been discovered in Node.js,  where the use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition." ],
  "statement" : "This vulnerability is rated as an IMPORTANT severity because this vulnerability is a policy bypass resulting from the improper handling of the JavaScript prototype chain. A malicious actor can trigger this flaw by using process.mainModule.__proto__.require() to load and execute modules explicitly disallowed by the policy.json configuration.\nSuccessful exploitation allows for the execution of unauthorized code within the context of the application process, leading to a compromise of system integrity.\nAt the time of this CVE's disclosure, the affected policy mechanism was designated as an experimental feature.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2023-08-08T00:00:00Z",
    "advisory" : "RHSA-2023:4536",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "nodejs:18-8080020230718130356.63b34585"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2023-08-08T00:00:00Z",
    "advisory" : "RHSA-2023:4537",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "nodejs:16-8080020230718141521.63b34585"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.6 Extended Update Support",
    "release_date" : "2023-09-26T00:00:00Z",
    "advisory" : "RHSA-2023:5361",
    "cpe" : "cpe:/a:redhat:rhel_eus:8.6",
    "package" : "nodejs:16-8060020230906023909.ad008a3a"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-07-31T00:00:00Z",
    "advisory" : "RHSA-2023:4330",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "nodejs:18-9020020230717125503.rhel9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2023-07-31T00:00:00Z",
    "advisory" : "RHSA-2023:4331",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "nodejs-1:16.20.1-1.el9_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.0 Extended Update Support",
    "release_date" : "2023-10-09T00:00:00Z",
    "advisory" : "RHSA-2023:5533",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.0",
    "package" : "nodejs-1:16.20.2-1.el9_0"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Will not fix",
    "package_name" : "nodejs:14/nodejs",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Software Collections",
    "fix_state" : "Will not fix",
    "package_name" : "rh-nodejs14-nodejs",
    "cpe" : "cpe:/a:redhat:rhel_software_collections:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2023-30581\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-30581" ],
  "name" : "CVE-2023-30581",
  "csaw" : false
}