CVE-2023-39333 Code injection in Node
Attackers can inject JavaScript code via malicious WebAssembly export names in Node.js, potentially accessing unauthorized data and functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-39333?
CVE-2023-39333 is a medium-severity code injection vulnerability in NodeJS Node, published on 7 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.
This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.
Weakness: CWE-94
Which versions are affected by CVE-2023-39333?
2 open source packages ship an affected version, including node and node-min.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | All versions | 18.18.2, 20.8.1 |
node-min Bitnami | All versions | 18.18.2, 20.8.1 |
How do I fix CVE-2023-39333?
Upgrade node to a fixed version for your release line: 18.18.2 or 20.8.1.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-39333 being exploited?
There is no known exploitation of CVE-2023-39333 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2023-39333, BIT-node-2023-39333, BIT-node-min-2023-39333, CLEANSTART-2026-MJ23189, CLEANSTART-2026-WI63302, CLSA-2025-1762361695 and 3 more.