CVE-2025-23083

CVE Details

Release Date:

2025-01-22

Description

With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. \nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.

See more information about CVE-2025-23083 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.7
Vector String:	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Version:	3.0
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	High
Integrity Impact:	High
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (nodejs)	ELSA-2025-1351	2025-02-13
Oracle Linux version 8 (nodejs)	ELSA-2025-1611	2025-02-18
Oracle Linux version 8 (nodejs-nodemon)	ELSA-2025-1351	2025-02-13
Oracle Linux version 8 (nodejs-nodemon)	ELSA-2025-1611	2025-02-18
Oracle Linux version 8 (nodejs-packaging)	ELSA-2025-1351	2025-02-13
Oracle Linux version 8 (nodejs-packaging)	ELSA-2025-1611	2025-02-18
Oracle Linux version 9 (nodejs)	ELSA-2025-1443	2025-02-14
Oracle Linux version 9 (nodejs)	ELSA-2025-1613	2025-02-19
Oracle Linux version 9 (nodejs-nodemon)	ELSA-2025-1443	2025-02-14
Oracle Linux version 9 (nodejs-nodemon)	ELSA-2025-1613	2025-02-19
Oracle Linux version 9 (nodejs-packaging)	ELSA-2025-1443	2025-02-14
Oracle Linux version 9 (nodejs-packaging)	ELSA-2025-1613	2025-02-19