CVE-2023-23918

A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.

The vulnerability in question can only be triggered by an attacker if the victim has enabled --experimental-policy which in many node.js deployments won't ,which marks the conditions for exploitability outside of the attacker's control.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Turn off the --experimental-policy in your Node.js deployment.