{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-23090", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2025-01-10T19:05:52.772Z", "datePublished": "2025-01-22T01:11:30.802Z", "dateUpdated": "2025-02-10T23:13:08.999Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers\n but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage.\n\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23."}], "affected": [{"defaultStatus": "unaffected", "vendor": "Node.js", "product": "node", "versions": [{"version": "20.18.1", "status": "affected", "lessThanOrEqual": "20.18.1", "versionType": "semver"}, {"version": "22.13.0", "status": "affected", "lessThanOrEqual": "22.13.0", "versionType": "semver"}, {"version": "23.6.0", "status": "affected", "lessThanOrEqual": "23.6.0", "versionType": "semver"}]}], "references": [{"url": "https://hackerone.com/reports/2575105"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 7.7, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2025-01-22T01:11:30.802Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-23T17:07:10.325913Z", "id": "CVE-2025-23090", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T23:13:08.999Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-23090", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-23T17:07:10.325913Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T23:13:03.280Z"}}], "cna": {"metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}}], "affected": [{"vendor": "Node.js", "product": "node", "versions": [{"status": "affected", "version": "20.18.1", "versionType": "semver", "lessThanOrEqual": "20.18.1"}, {"status": "affected", "version": "22.13.0", "versionType": "semver", "lessThanOrEqual": "22.13.0"}, {"status": "affected", "version": "23.6.0", "versionType": "semver", "lessThanOrEqual": "23.6.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://hackerone.com/reports/2575105"}], "descriptions": [{"lang": "en", "value": "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers\n but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage.\n\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23."}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2025-01-22T01:11:30.802Z"}}}, "cveMetadata": {"cveId": "CVE-2025-23090", "state": "PUBLISHED", "dateUpdated": "2025-02-10T23:13:08.999Z", "dateReserved": "2025-01-10T19:05:52.772Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2025-01-22T01:11:30.802Z", "assignerShortName": "hackerone"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers\n but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage.\n\nThis vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23."}, {"lang": "es", "value": "Con la ayuda de la utilidad diagnostics_channel, se puede conectar un evento cada vez que se crea un subproceso de trabajo. Esto no se limita solo a los trabajadores, sino que tambi\u00e9n expone a los trabajadores internos, donde se puede obtener una instancia de ellos y se puede obtener su constructor y restablecerlo para un uso malintencionado. Esta vulnerabilidad afecta a los usuarios del modelo de permisos (--permission) en Node.js v20, v22 y v23."}], "id": "CVE-2025-23090", "lastModified": "2025-02-11T00:15:29.570", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "support@hackerone.com", "type": "Secondary"}]}, "published": "2025-01-22T02:15:34.443", "references": [{"source": "support@hackerone.com", "url": "https://hackerone.com/reports/2575105"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}