CVE-2023-32558

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal

published September 12, 2023

CVSS
—
EPSS
2%
Percentile
77.6
In the wild
Unconfirmed
What it is

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal.

This vulnerability affects all users using the experimental permission model in Node.js 20.x.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01743 · 77.6th percentile
Published
2023-09-12T01:36Z
EPSS history
Timeline
  • 12 SEP 01:36Z
    The use of the deprecated API `process.binding()` can bypass the permission model through path traversal
    cvelistv5