CVE-2018-7160: node.js from 6.0.0 (inclusive), through 6.8.1 (inclusive), from 6.9.0 (inclusive), before 6.14.0 (exclusive), from…

Affected technology

node.js · from 6.0.0 (inclusive), through 6.8.1 (inclusive)
nodejs

node.js · from 6.9.0 (inclusive), before 6.14.0 (exclusive)
nodejs

node.js · from 8.0.0 (inclusive), through 8.8.1 (inclusive)
nodejs

node.js · from 8.9.0 (inclusive), before 8.11.0 (exclusive)
nodejs

node.js · from 9.0.0 (inclusive), before 9.10.0 (exclusive)
nodejs

Node.js · ^6.0.0 || ^8.0.0 || ^9.0.0
The Node.js Project

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

The source reports that an attacker could run code remotely under the conditions described by the source. NVD’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high.