Read the docs
TI-2023-11279 Aliases CVE-2023-26045GHSA-vh2g-6c4x-5hmp

NodeBB vulnerable to path traversal and code execution via prototype vulnerability

Priority MEDIUM 51CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk. This issue is patched in version 2.8.7. As a workaround, site maintainers can cherry pick the fix into their codebase to patch the exploit.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01029 63rd percentileScored 2026-11-07
Fix Fixed NodeBB (NodeBB): 2.8.7nodebb (npm): 2.8.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NodeBBNodeBB2.5.0 to before 2.8.72.8.7Patch availableCNA
—nodebb (npm)2.5.0 to before 2.8.72.8.7Patch availableGHSA-vh2g-6c4x-5hmp
  • NodeBB VendorNodeBB Affected 2.5.0 to before 2.8.7 Fixed in 2.8.7 Patch available CNA
  • nodebb (npm) Vendor— Affected 2.5.0 to before 2.8.7 Fixed in 2.8.7 Patch available GHSA-vh2g-6c4x-5hmp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:node.js:*:*2.5.0 to before 2.8.7VulnerableNodeBB
  • cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:node.js:*:* Versions 2.5.0 to before 2.8.7 Vulnerable ·NodeBB

Remediation

  • Fix · CNA NodeBB (NodeBB) Fixed in 2.8.7
  • Fix · GHSA-vh2g-6c4x-5hmp nodebb (npm) Fixed in 2.8.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-26045
  2. 2026-10-03 Alias added: GHSA-vh2g-6c4x-5hmp

References

Patch 1

Advisory 2

Other 3

  • TI-2023-23124 A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc… CVSS 3.1CRITICAL 9.8
  • TI-2022-22808 Account takeover via prototype vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-42173 NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User CVSS 4.0HIGH 8.7
  • TI-2025-32286 NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint… CVSS 3.1HIGH 8.6
  • TI-2023-14416 NodeBB Pre-Authentication Denial-of-Service CVSS 3.1HIGH 7.5
  • TI-2022-16499 Account takeover via SSO plugins in NodeBB CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences