{"answers":{"affected":"2 open source packages ship an affected version, including import-in-the-middle. It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-38704 in the wild and no public exploit code.","fix":"Upgrade import-in-the-middle to 1.4.2 or later.","what":"CVE-2023-38704 is a high-severity code injection vulnerability in DataDog import-in-the-middle, published on 7 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-38704 and fix it if it is affected.\n\nWhat it is: CVE-2023-38704 is a high-severity code injection vulnerability in DataDog import-in-the-middle, published on 7 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-38704 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- import-in-the-middle (npm): affected all versions; fixed in 1.4.2\n- import-in-the-middle (npm): affected all versions; fixed in 1.4.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-38704/ (Markdown: https://insights.sbomify.com/CVE-2023-38704/index.md)","id":"CVE-2023-38704","markdown":"https://insights.sbomify.com/CVE-2023-38704/index.md","name":"CVE-2023-38704","record":{"aliases":["GHSA-5r27-rw8r-7967","ROOT-APP-NPM-CVE-2023-38704"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Node.js ESM loader","requires_auth":"none","summary":"Attackers can execute arbitrary code if user input is passed to import() in applications using the import-in-the-middle library.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"import-in-the-middle","vendor":"datadoghq"}],"cvss":{"score":8.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"description":"import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. Prior to version 1.4.2, it allows for remote code execution in cases where an application passes user-supplied input directly to the `import()` function. This vulnerability has been patched in import-in-the-middle version 1.4.2.\n\nSome workarounds are available. Do not pass any user-supplied input to `import()`. Instead, verify it against a set of allowed values. If using import-in-the-middle, directly or indirectly, and support for EcmaScript Modules is not needed, ensure that no options are set, either via command-line or the `NODE_OPTIONS` environment variable, that would enable loader hooks.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"import-in-the-middle allows unsanitized user controlled input in module generation","id":"CVE-2023-38704","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"code_injection","year":"2023"},"n_packages":2,"n_references":2,"next":{"headline":"Discourse vulnerable to DoS via drafts","id":"CVE-2023-38706"},"packages":[{"ecosystem":"npm","fixed":["1.4.2"],"introduced":["0"],"last_affected":[],"package":"import-in-the-middle","purl":null,"source":"GHSA-5r27-rw8r-7967"},{"ecosystem":"npm","fixed":["1.4.2"],"introduced":["0"],"last_affected":[],"package":"import-in-the-middle","purl":"pkg:npm/import-in-the-middle","source":"GHSA-5r27-rw8r-7967"}],"prev":{"headline":"PJSIP has use-after-free vulnerability in SRTP media transport","id":"CVE-2023-38703"},"products":["import-in-the-middle"],"published":"2023-08-07","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-10-03","vendors":["DataDog"]},"summary":"Attackers can execute arbitrary code if user input is passed to import() in applications using the import-in-the-middle library.","url":"https://insights.sbomify.com/CVE-2023-38704/"}