CVE-2023-38704

Summary

CVE-2023-38704 is a vulnerability affecting the import-in-the-middle module, a loader for EcmaScript Modules. Prior to version 1.4.2, this loader allowed for remote code execution when user-supplied input was directly passed to the `import()` function. The issue arises from the loader's wrapper functionality, which generates a wrapper module on the fly and adds wrapping code. As a workaround, developers should avoid passing any user-supplied input to `import()`. Instead, verify input against a set of allowed values. If the use of import-in-the-middle is unavoidable and EcmaScript Module support isn't required, ensure that no options are enabled that would enable loader hooks. This vulnerability has been addressed in import-in-the-middle version 1.4.2.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.