Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Node.js Inspector Allows Remote Code Execution via Malicious Websites

CVE-2018-7160 · published 8 years ago
Summary

Vulnerable versions of Node.js (6.x and later) allow hackers to take control of your computer if you visit a malicious website. This can happen if the Node.js process is running with its debug port open on your local computer or your network. To protect yourself, ensure your Node.js processes are not running with the debug port open when visiting untrusted websites.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
npm taojie node-inspector >= 6.0
– nodejs node.js >= 6.0.0, <= 6.8.1
>= 6.9.0, < 6.14.0
>= 8.0.0, <= 8.8.1
>= 8.9.0, < 8.11.0
>= 9.0.0, < 9.10.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
– the node.js project node.js ^6.0.0 || ^8.0.0 || ^9.0.0
Original advisory text
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a we...
The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
10% chance of attack within 30 days
Type
CWE-290Authentication Bypass by Spoofing
CWE-350Reliance on Reverse DNS Resolution for a Security-Critical Action
Timeline
Published17 May 2018
Updated27 Oct 2026
First seen6 Mar 2026
Sources
GHSA-wq4c-wm6x-jw44 · GHSA
CVE-2018-7160 · NVD
CVE-2018-7160 · MITRE
Track software like this
Free during beta