CVE-2023-39333

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code

Medium · published September 7, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
65.6
In the wild
Unconfirmed
What it is

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.

This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01107 · 65.6th percentile
Published
2024-09-07T16:00Z
EPSS history
Timeline
  • 07 SEP 16:00Z
    Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code
    cvelistv5