UpHeron
All vulnerabilities

Servers and applications

CVE-2023-39331

Permission model improperly protects against path traversal

Severity
High 7.5
Published
13 Oct 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
20.8.1
Sources
NVD, nodejs

Description

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an experimental feature of…

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 20.0.0 before 20.8.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-39331
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-39331
  • Node.js security release https://nodejs.org/en/blog/vulnerability/october-2023-security-releases