CVE-2023-32558 json
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal.
published 2023-09-12 3 y ago modified 2026-11-02 6 d ago also BIT-node-2023-32558 , BIT-node-min-2023-32558 , EUVD-2023-36802
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
The use of the deprecated API `process.binding()` can bypass the permission model through path traversal.
This vulnerability affects all users using the experimental permission model in Node.js 20.x.
Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.
Patch / fix
- bitnami node 20.5.1
- bitnami node-min 20.5.1
- NodeJS Node 20.5.1
- nodejs20 openSUSE Tumbleweed 20.5.1-1.1
opensuse advisories openSUSE-SU-2024:13117-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-32558 updated cvss 7.5
nodejs: process.binding() can bypass the permission model through path traversal
-
Red Hat Enterprise Linux 8 npm, nodejs, nodejs-libs, nodejs-nodemon, nodejs-full-i18n, nodejs-packaging, +1 more Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n Red Hat Software Collections rh-nodejs14-npm, rh-nodejs14-nodejs, rh-nodejs14-nodejs-full-i18nnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-24-319-08 updated cvss 7.5
Siemens SINEC INS
-
Siemens SINEC INS <V1.0_SP2_Update_3affected: fixed in V1.0 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-24-046-15 updated cvss 7.5
Siemens SINEC NMS
-
Siemens SINEC NMS <V2.0_SP1affected: fixed in V2.0 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 31 d ago
Exploit prediction
1.74% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- hackerone.com https://hackerone.com/reports/2051257 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | node | >=20.0.0, <20.5.1 |
20.5.1 |
| bitnami | node-min | >=20.0.0, <20.5.1 |
20.5.1 |
Affected products
- NodeJS Node
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
- Technology feeds
References
-
hackerone.com
/reports/2051257
exploit, third-party-advisory, advisory
-
security.netapp.com
/advisory/ntap-20241025-0003/
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-32558
web
Sources
- CVE List CVE-2023-32558
- NVD CVE-2023-32558
- OSV BIT-node-2023-32558
- OSV BIT-node-min-2023-32558
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.