CVE-2023-38704
CVSS 3.1 Score 8.1 of 10 (high)
Details
Summary
CVE-2023-38704 is a vulnerability in the import-in-the-middle module loading interceptor, specifically for ESM modules. Versions prior to 1.4.2 allow for remote code execution if an application passes user-supplied input directly to the `import()` function. The vulnerability has been patched in import-in-the-middle version 1.4.2. To remediate this vulnerability, it is advised not to pass any user-supplied input to `import()`. Instead, verify the input against a set of allowed values. Additionally, if using import-in-the-middle and support for EcmaScript Modules is not needed, ensure that no options are set, either via command-line or the `NODE_OPTIONS` environment variable, that would enable loader hooks. This vulnerability poses a high risk to organizations as it can lead to remote code execution and potential compromise of confidentiality and integrity of data.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions