Loading vulnerability…
Untrusted ICU Data Search Path in Node.js
CVE-2023-23920 is an untrusted search path vulnerability in Node.js ICU data loading. Affected releases can search for and potentially load user-controlled International Components for Unicode (ICU) data through the ICU_DATA environment variable even when Node.js executes with elevated privileges. This permits untrusted data to influence a privileged process and compromises integrity. Affected release lines include Node.js 14 before 14.21.3, 16 before 16.19.1, 18 before 18.14.1, and 19 before 19.6.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the integrity of a privileged Node.js process by causing it to consume attacker-controlled ICU data. The vulnerability is rated CVSS 3.1 4.2 with vector AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N, indicating high integrity impact without assessed confidentiality or availability impact. Arbitrary code execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
Until patched, avoid executing affected Node.js installations with elevated privileges. Where privileged execution is unavoidable, sanitize the execution environment so that an untrusted ICU_DATA value cannot reach the process, and prevent untrusted users from modifying any permitted ICU data locations. These precautions do not replace the fixed build.
Patch, then assume compromise.
Upgrade to a supported Node.js release containing the fix. The original fixed releases are 14.21.3, 16.19.1, 18.14.1, and 19.6.1. The fix builds Node.js with ICU_NO_USER_DATA_OVERRIDE to prevent user-controlled ICU data overrides. Distribution-maintained installations should apply the corresponding vendor security update; Debian 10 supplied the fix in nodejs 10.24.0~dfsg-1~deb10u3.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.