Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2023-30587

A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in…

High7.5EPSS 0.75%
Published
Updated
Reserved
Assigned by
hackerone

Description

A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector). By exploiting the Worker class's ability to create an "internal worker" with the kIsInternal Symbol, attackers can modify the isInternal value when an inspector is attached within the Worker constructor before initializing a new WorkerImpl. This vulnerability exclusively affects Node.js users employing the permission model mechanism. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Scores

CVSS scores of CVE-2023-30587, by who scored it
Scored byCVSSScoreVector
CISA-ADPADP (enrichment)3.1High7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVDNVD · Deferred3.1High7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS (exploitation in 30 days)
0.75% · top 45% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Affected products

  • NodeJS · Node

    • affected 4.0 – < 4.*
    • affected 5.0 – < 5.*
    • affected 6.0 – < 6.*
    • affected 7.0 – < 7.*
    • affected 8.0 – < 8.*
    • affected 9.0 – < 9.*
    • affected 10.0 – < 10.*
    • affected 11.0 – < 11.*
    • affected 12.0 – < 12.*
    • affected 13.0 – < 13.*
    • affected 14.0 – < 14.*
    • affected 15.0 – < 15.*
    • affected 17.0 – < 17.*
    • affected 19.0 – < 19.*
    • affected 20.0 – < 20.3.1

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2023-30587 badge
[![CVE-2023-30587](https://trackcve.app/badge/CVE-2023-30587.svg)](https://trackcve.app/cve/CVE-2023-30587)

Record last updated .