CVE-2023-38704
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
The import-in-the-middle module, used for loading ESM modules, prior to version 1.4.2 allowed for remote code execution when an application passed user-supplied input directly to the `import()` function. Version 1.4.2 introduces fixes that mitigate this vulnerability.
Risk Assessment
Organizations may be exposed to remote code execution, which can lead to serious security breaches and data loss.
Recommendation
It is recommended not to pass user-supplied input to the `import()` function, and instead verify it against a set of allowed values. If using import-in-the-middle, ensure that no options are set that would enable loader hooks.
Related vulnerabilities
- CVE-2026-96659Critical
A flaw in Foreman allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. The user can access sensitive data such as host root passwords. Under insecure configurations with Safemode disabled, the flaw may also allow arbitrary command execution as the Foreman system account.
- CVE-2026-96658Critical
A flaw in Foreman allows an authenticated attacker with low-level permissions to achieve remote code execution (RCE) by bypassing the Safemode sandbox within the templating engine. Due to improper handling of delegated methods, the attacker can append unauthorized functions to the allowed execution list, enabling arbitrary command execution on the hosting server.
- CVE-2026-13043Critical
The Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products does not properly enforce authentication. A local, authenticated attacker can bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory.
- CVE-2026-94620Critical
Classroom 50 prior to version 1.11.0, when running `gh teacher download`, clones each student's assignment repository and then writes autograde artifacts (`result.json` and `results.json`) into the just-cloned working tree. The write followed symlinks, so a student who committed `result.json` or `results.json` as a symlink could redirect the teacher's write to an arbitrary path (e.g. `~/.zshrc`, `~/.ssh/authorized_keys`, a cron file, or an in-clone `.git/hooks/*` file), with attacker-controlled bytes. This is an arbitrary file write leading to code execution as the teacher, whose `gh` token carries `admin:org`, `repo`, and `workflow` across the entire classroom organization.
- CVE-2026-12627Critical
Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing.
- CVE-2026-79898Critical
Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master.
- CVE-2026-62071Critical
The WordPress File Upload plugin in versions up to and including 5.1.10 contains an SQL injection vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-103752Critical
The Authorizer plugin in versions up to and including 3.15.3 contains an unauthenticated privilege escalation vulnerability.
- CVE-2026-79901Critical
In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.
- CVE-2026-103264Critical
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.
Original NVD description (English source)
import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. Prior to version 1.4.2, it allows for remote code execution in cases where an application passes user-supplied input directly to the `import()` function. This vulnerability has been patched in import-in-the-middle version 1.4.2. Some workarounds are available. Do not pass any user-supplied input to `import()`. Instead, verify it against a set of allowed values. If using import-in-the-middle, directly or indirectly, and support for EcmaScript Modules is not needed, ensure that no options are set, either via command-line or the `NODE_OPTIONS` environment variable, that would enable loader hooks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS