What is GHSA-h9p4-9jqg-j34h?

GHSA-h9p4-9jqg-j34h is a security advisory published by GitHub Security Advisories with High severity. The use of the deprecated API `process.binding()` can bypass the permission model through path...

Which CVE IDs does GHSA-h9p4-9jqg-j34h cover?

GHSA-h9p4-9jqg-j34h covers the following CVE IDs: CVE-2023-32558. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h9p4-9jqg-j34h?

GHSA-h9p4-9jqg-j34h has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-h9p4-9jqg-j34hHighCVSS 7.5

The use of the deprecated API `process.binding()` can bypass the permission model through path...

Vendor

GitHub Security Advisories

Published

September 15, 2023

Last Modified

November 3, 2026

🔗 CVE IDs covered (1)

CVE-2023-32558 →

📋 Description

The use of the deprecated API process.binding() can bypass the permission model through path traversal.

This vulnerability affects all users using the experimental permission model in Node.js 20.x.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-32558
https://hackerone.com/reports/2051257
https://security.netapp.com/advisory/ntap-20241025-0003
https://github.com/advisories/GHSA-h9p4-9jqg-j34h