What is CVE-2023-32002?

CVE-2023-32002 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. HackerOne: CVE-2023-32002 Node.js `Module._load()` policy Remote Code Execution Vulnerability

Which CVE IDs does CVE-2023-32002 cover?

CVE-2023-32002 covers the following CVE IDs: CVE-2023-32002. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by CVE-2023-32002?

CVE-2023-32002 affects 3 products, including: CBL Mariner 2.0 ARM; CBL Mariner 2.0 x64; Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10).

CVE-2023-32002High

HackerOne: CVE-2023-32002 Node.js `Module._load()` policy Remote Code Execution Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

June 3, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2023-32002 →

📋 Description

Why is this HackerOne CVE included in the Security Update Guide? The vulnerability assigned to this CVE is in Node.js software which is consumed by Microsoft Visual Studio. It is being documented in the Security Update Guide to announce that the latest builds of Visual Studio are no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

🎯 Affected products3

CBL Mariner 2.0 ARM
CBL Mariner 2.0 x64
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)

✅ Remediation

KBRelease Notes (Security Update) — fixed build 16.11.44 KBnodejs (CBL-Mariner) — fixed build 16.20.2-2 KBnodejs18 (CBL-Mariner) — fixed build 18.17.1-2

🔗 References (4)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32002
patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2019 version 16.11
referencehttps://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.11
referencehttps://nvd.nist.gov/vuln/detail/CVE-2023-32002