CVE-2023-32558

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The use of the deprecated API `process.binding()` can bypass the permission model through path traversal.

This vulnerability affects all users using the experimental permission model in Node.js 20.x.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Sep 12, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-325597.5A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use CVE-2023-32568.1Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files.CVE-2023-325609.8An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary coCVE-2023-325617.5A previously generated artifact by an administrator could be accessed by an attacker. The contents of this artifact could lead to authenticaCVE-2023-325629.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker tCVE-2023-325639.8An unauthenticated attacker could achieve the code execution through a RemoteControl server.CVE-2023-325649.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker tCVE-2023-325659.1An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. FCVE-2023-325669.1An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. FCVE-2023-325679.8Ivanti Avalanche decodeToMap XML External Entity Processing. Fixed in version 6.4.1.236CVE-2023-325687.2An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application doeCVE-2023-325699.8An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The InfoScale VIOM web appli
CVE-2023-32558: High severity, CVSS 7.5 | Vulnix