CVE-2023-39333

Description

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.

How to fix CVE-2023-39333

To remediate CVE-2023-39333, upgrade the affected package to a fixed version below.

• —upgrade to 18.18.2-r0 or later
• —upgrade to 18.18.2 or later
• —upgrade to 18.18.2 or later
• —upgrade to 18.19.0+dfsg-6~deb12u1 or later

Is CVE-2023-39333 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 18.18.2-r0
• from 0, < 18.18.2, >= 19.0.0, < 20.8.1
• from 0, < 18.18.2, >= 19.0.0, < 20.8.1
• from 0, < 18.19.0+dfsg-6~deb12u1

CVSS scores

References (7)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2023-39333
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2023-39333
• WEBnodejs.org/en/blog/vulnerability/october-2023-security-releases
• WEBnvd.nist.gov/vuln/detail/CVE-2023-39333