description: The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js
affected:
{
defaultStatus: unaffected
vendor: Node.js
product: Node.js
versions:
version: 16.20.1, status: affected, lessThan: 16.20.1, versionType: semver
version: 18.16.1, status: affected, lessThan: 18.16.1, versionType: semver
version: 20.3.1, status: affected, lessThan: 20.3.1, versionType: semver
}