{"id":"CVE-2018-7160","revision":"7e9f0f131a3b43d8bea53b60da811743","records":[{"revision":"7e9f0f131a3b43d8bea53b60da811743","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2018-7160","aliases":[],"title":"The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another …","description":"The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.","state":0,"publishedAt":"2018-05-17T14:00:00+00:00","modifiedAt":"2026-10-08T21:14:05.004+00:00","affected":[{"ecosystem":"Vendor product","name":"Node.js","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Node.js\",\n                    \"vendor\": \"The Node.js Project\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"^6.0.0 || ^8.0.0 || ^9.0.0\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://www.oracle.com//security-alerts/cpujul2021.html","https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/","https://support.f5.com/csp/article/K63025104?utm_source=f5support&amp%3Butm_medium=RSS"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2018-7160","license":"CVE Program Terms of Use","key":"cve-program:CVE-2018-7160","identifiers":["CVE-2018-7160"]},"retained":false,"historicalAffected":[]}],"coverage":[]}