CVE-2023-30585: node.js from 16.0.0 (inclusive), before 16.20.1 (exclusive), from 18.0.0 (inclusive), before 18.16.1 (exclusive), from…

Affected technology

node.js · from 16.0.0 (inclusive), before 16.20.1 (exclusive)
nodejs

node.js · from 18.0.0 (inclusive), before 18.16.1 (exclusive)
nodejs

node.js · from 20.0.0 (inclusive), before 20.3.1 (exclusive)
nodejs

Node · 4.0 to before 4.*, 5.0 to before 5.*, 6.0 to before 6.*, 7.0 to before 7.*, 8.0 to before 8.*, 9.0 to before 9.*, 10.0 to before 10.*, 11.0 to before 11.*, 12.0 to before 12.*, 13.0 to before 13.*, 14.0 to before 14.*, 15.0 to before 15.*, 16.0 to before 16.20.1, 17.0 to before 17.*, 18.0 to before 18.16.1, 19.0 to before 19.*, 20.0 to before 20.3.1
NodeJS

Description’s affected range: version) installation process, specifically affecting Windows users who install Node.js using the .msi installer

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and availability impact as none; integrity impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.