CVE-2023-32004

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions.

This vulnerability affects all users using the experimental permission model in Node.js 20.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Aug 15, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-320055.3A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flaCVE-2023-320068.8The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition foCVE-2023-320078.8** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. WiCVE-2023-320087.8Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityCVE-2023-320098.8Windows Collaborative Translation Framework Elevation of Privilege VulnerabilityCVE-2023-32014.3The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_ordCVE-2023-320107.0Windows Bus Filter Driver Elevation of Privilege VulnerabilityCVE-2023-320117.5Windows iSCSI Discovery Service Denial of Service VulnerabilityCVE-2023-320127.8Windows Container Manager Service Elevation of Privilege VulnerabilityCVE-2023-320135.3Windows Hyper-V Denial of Service VulnerabilityCVE-2023-320149.8Windows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityCVE-2023-320159.8Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
CVE-2023-32004: High severity, CVSS 8.8 | Vulnix