CVE-2023-32002

Name of the Vulnerable Software and Affected Versions Node.js versions 16.x through 20.x

Description The issue is related to the Module. load() function, which can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This affects users using the experimental policy mechanism in all active release lines. The policy is an experimental feature of Node.js.

Recommendations For Node.js versions 16.x through 20.x, update to a version that includes the fix for the issue, as the policy mechanism can be bypassed via Module. load(). At the moment, there is no information about a newer version that contains a fix for this vulnerability, however, it is mentioned that the issue is fixed in an unofficial release.