Policy-restricted modules can escalate to higher privileges by impersonating other modules in a policy list using module.constructor.createRequire()

Posted on August 12, 2023by bugbounty

Node.js disclosed a bug submitted by haxatron1: https://hackerone.com/reports/2043807