Skip to content
Fencer Vulns
high 7.5

CVE-2023-30585 json

A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install No…

published 2023-11-28 2 y ago modified 2026-10-08 31 d ago also BIT-node-2023-30585 , BIT-node-min-2023-30585 , EUVD-2023-34966

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

A vulnerability has been identified in the Node.js (.msi version) installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM context, attempts to read the %USERPROFILE% environment variable from the current user's registry.

The issue arises when the path referenced by the %USERPROFILE% environment variable does not exist. In such cases, the "msiexec.exe" process attempts to create the specified path in an unsafe manner, potentially leading to the creation of arbitrary folders in arbitrary locations.

The severity of this vulnerability is heightened by the fact that the %USERPROFILE% environment variable in the Windows registry can be modified by standard (or "non-privileged") users. Consequently, unprivileged actors, including malicious entities or trojans, can manipulate the environment variable key to deceive the privileged "msiexec.exe" process. This manipulation can result in the creation of folders in unintended and potentially malicious locations.

It is important to note that this vulnerability is specific to Windows users who install Node.js using the .msi installer. Users who opt for other installation methods are not affected by this particular issue.

Patch / fix

  • bitnami node 16.20.1, 18.16.1, 20.3.1
  • bitnami node-min 16.20.1, 18.16.1, 20.3.1
  • NodeJS Node 16.20.1, 18.16.1, 20.3.1
  • nodejs16 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +3 more 16.20.1-150300.7.24.2
  • nodejs18 SLE Module for Web and Scripting 15 SP5, SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.5 +1 more 18.16.1-150400.9.9.1
  • nodejs16 SLE Module for Web and Scripting 15 SP4, openSUSE Leap 15.4 16.20.1-150400.3.21.1
  • nodejs18 SLE Module for Web and Scripting 12 18.16.1-8.9.1
  • nodejs16 SLE Module for Web and Scripting 12 16.20.1-8.30.1

suse advisories SUSE-SU-2023:2861-1SUSE-SU-2023:2669-1SUSE-SU-2023:2663-1SUSE-SU-2023:2662-1SUSE-SU-2023:2655-1

  • nodejs20 openSUSE Tumbleweed 20.3.1-1.1

opensuse advisories openSUSE-SU-2024:13021-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-30585 updated cvss 7.5

nodejs: privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process

  • Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-full-i18n
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
31 d ago

Exploit prediction

1.47% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
bitnami node
>=16.0.0, <16.20.1
>=18.0.0, <18.16.1
>=20.0.0, <20.3.1
16.20.1
18.16.1
20.3.1
bitnami node-min
>=16.0.0, <16.20.1
>=18.0.0, <18.16.1
>=20.0.0, <20.3.1
16.20.1
18.16.1
20.3.1

Affected products

  • NodeJS Node

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.