CVE-2023-38704
CVSS 3.1 Score 9.8 of 10 (high)
Details
Summary
CVE-2023-38704 is a vulnerability affecting the import-in-the-middle module, a loader for EcmaScript Modules. Prior to version 1.4.2, this loader allowed for remote code execution when user-supplied input was directly passed to the `import()` function. The issue arises from the loader's wrapper functionality, which generates a wrapper module on the fly and adds wrapping code. As a workaround, developers should avoid passing any user-supplied input to `import()`. Instead, verify input against a set of allowed values. If the use of import-in-the-middle is unavoidable and EcmaScript Module support isn't required, ensure that no options are enabled that would enable loader hooks. This vulnerability has been addressed in import-in-the-middle version 1.4.2.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions