CVE-2023-38704 json
import-in-the-middle allows unsanitized user controlled input in module generation
published 2023-08-07 3 y ago modified 2026-09-10 1 mo ago also GHSA-5r27-rw8r-7967 , EUVD-2023-2217
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. Prior to version 1.4.2, it allows for remote code execution in cases where an application passes user-supplied input directly to the `import()` function. This vulnerability has been patched in import-in-the-middle version 1.4.2.
Some workarounds are available. Do not pass any user-supplied input to `import()`. Instead, verify it against a set of allowed values. If using import-in-the-middle, directly or indirectly, and support for EcmaScript Modules is not needed, ensure that no options are set, either via command-line or the `NODE_OPTIONS` environment variable, that would enable loader hooks.
Patch / fix
- npm import-in-the-middle 1.4.2
- datadoghq import-in-the-middle 1.4.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.00% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | import-in-the-middle | <1.4.2 |
1.4.2 |
Affected products
- DataDog import-in-the-middle
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/DataDog/import-in-the-middle/commit/2531cdd9d1d73f9eaa87c16967f60cb276c1971b
web, patch
-
github.com
/DataDog/import-in-the-middle/security/advisories/GHSA-5r27-rw8r-7967
web, mitigation, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-38704
advisory
-
github.com
/DataDog/import-in-the-middle
package
Sources
- CVE List CVE-2023-38704
- GitHub Advisory GHSA-5r27-rw8r-7967
- NVD CVE-2023-38704
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.