{"affected":[{"defaultStatus":"unaffected","product":"Node","source":"CNA: hackerone","vendor":"NodeJS","versions":[{"lessThan":"4.*","status":"affected","version":"4.0","versionType":"semver"},{"lessThan":"5.*","status":"affected","version":"5.0","versionType":"semver"},{"lessThan":"6.*","status":"affected","version":"6.0","versionType":"semver"},{"lessThan":"7.*","status":"affected","version":"7.0","versionType":"semver"},{"lessThan":"8.*","status":"affected","version":"8.0","versionType":"semver"},{"lessThan":"9.*","status":"affected","version":"9.0","versionType":"semver"},{"lessThan":"10.*","status":"affected","version":"10.0","versionType":"semver"},{"lessThan":"11.*","status":"affected","version":"11.0","versionType":"semver"},{"lessThan":"12.*","status":"affected","version":"12.0","versionType":"semver"},{"lessThan":"13.*","status":"affected","version":"13.0","versionType":"semver"},{"lessThan":"14.*","status":"affected","version":"14.0","versionType":"semver"},{"lessThan":"15.*","status":"affected","version":"15.0","versionType":"semver"},{"lessThan":"17.*","status":"affected","version":"17.0","versionType":"semver"},{"lessThan":"19.*","status":"affected","version":"19.0","versionType":"semver"},{"lessThan":"20.5.1","status":"affected","version":"20.0","versionType":"semver"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","versionEndExcluding":"20.5.1","versionStartIncluding":"20.0.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2023-32558","cwes":["CWE-22"],"description":"The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. \n\nThis vulnerability affects all users using the experimental permission model in Node.js 20.x.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.","epss":{"date":"2026-11-02","percentile":0.77774,"score":0.01743},"exploits":[{"kind":"exploit","source":"support@hackerone.com","url":"https://hackerone.com/reports/2051257"},{"kind":"exploit","source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://hackerone.com/reports/2051257"}],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}],"modifiedAt":1793661436480,"publishedAt":1694482615861,"references":[{"source":"CNA: hackerone","tags":[],"url":"https://hackerone.com/reports/2051257"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://hackerone.com/reports/2051257"},{"source":"ADP: CVE","tags":[],"url":"https://security.netapp.com/advisory/ntap-20241025-0003/"},{"source":"support@hackerone.com","tags":["Exploit","Third Party Advisory"],"url":"https://hackerone.com/reports/2051257"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://hackerone.com/reports/2051257"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"url":"https://security.netapp.com/advisory/ntap-20241025-0003/"}],"remediation":[],"revision":"16c20c323d2f9d73481e23a077671008f4d11dd170310aa78179e499d0816bc9","sources":[{"modifiedAt":1793658926152,"name":"CNA: hackerone","retrievedAt":1793660917931,"url":"https://www.cve.org/CVERecord?id=CVE-2023-32558"},{"modifiedAt":1793661436480,"name":"NVD","retrievedAt":1793665099689,"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32558"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793660921630,"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-32558"}],"ssvc":{"assessedAt":1791493656422,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"CVE-2023-32558","updatedAt":1793665099689}