CVSS 3.1 Score 8.1 of 10 (high)


Published Aug 7, 2023
Updated: Aug 11, 2023


CVE-2023-38704 is a vulnerability in the import-in-the-middle module loading interceptor, specifically for ESM modules. Versions prior to 1.4.2 allow for remote code execution if an application passes user-supplied input directly to the `import()` function. The vulnerability has been patched in import-in-the-middle version 1.4.2. To remediate this vulnerability, it is advised not to pass any user-supplied input to `import()`. Instead, verify the input against a set of allowed values. Additionally, if using import-in-the-middle and support for EcmaScript Modules is not needed, ensure that no options are set, either via command-line or the `NODE_OPTIONS` environment variable, that would enable loader hooks. This vulnerability poses a high risk to organizations as it can lead to remote code execution and potential compromise of confidentiality and integrity of data.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-38704 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options