CVE-2023-30581

A vulnerability has been discovered in Node.js, where the use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition.

This vulnerability is rated as an IMPORTANT severity because this vulnerability is a policy bypass resulting from the improper handling of the JavaScript prototype chain. A malicious actor can trigger this flaw by using process.mainModule.proto.require() to load and execute modules explicitly disallowed by the policy.json configuration.

Successful exploitation allows for the execution of unauthorized code within the context of the application process, leading to a compromise of system integrity.

At the time of this CVE's disclosure, the affected policy mechanism was designated as an experimental feature.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.