FKIE_CVE-2025-23083

Vulnerability from fkie_nvd - Published: 2025-01-22 02:15 - Updated: 2025-07-22 16:15
Severity ?
7.7 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.
References
support@hackerone.comhttps://nodejs.org/en/blog/vulnerability/january-2025-security-releases
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20250228-0008/
af854a3a-2127-422b-91ae-364da2661108https://www.vicarius.io/vsociety/posts/cve-2025-23083-detect-nodejs-vulnerability
af854a3a-2127-422b-91ae-364da2661108https://www.vicarius.io/vsociety/posts/cve-2025-23083-mitigate-nodejs-vulnerability
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. \r\n\r\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23."
    },
    {
      "lang": "es",
      "value": "Con la ayuda de la utilidad diagnostics_channel, se puede conectar un evento cada vez que se crea un subproceso de trabajo. Esto no se limita solo a los trabajadores, sino que tambi\u00e9n expone a los trabajadores internos, donde se puede obtener una instancia de ellos y se puede obtener su constructor y restablecerlo para un uso malintencionado. Esta vulnerabilidad afecta a los usuarios del modelo de permisos (--permission) en Node.js v20, v22 y v23."
    }
  ],
  "id": "CVE-2025-23083",
  "lastModified": "2025-07-22T16:15:26.760",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.2,
        "source": "support@hackerone.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-01-22T02:15:33.930",
  "references": [
    {
      "source": "support@hackerone.com",
      "url": "https://nodejs.org/en/blog/vulnerability/january-2025-security-releases"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20250228-0008/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.vicarius.io/vsociety/posts/cve-2025-23083-detect-nodejs-vulnerability"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.vicarius.io/vsociety/posts/cve-2025-23083-mitigate-nodejs-vulnerability"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.