{"id":"CVE-2018-7160","revision":"9ce21b27cbb048dbb18a30f5ebc08c76","records":[{"revision":"9ce21b27cbb048dbb18a30f5ebc08c76","observedAt":"2026-10-24T15:17:10.449+00:00","statement":{"source":"nvd","id":"CVE-2018-7160","aliases":[],"title":"The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another …","description":"The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.","state":0,"publishedAt":"2018-05-17T14:29:00.827+00:00","modifiedAt":"2026-10-08T22:16:47.647+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"},{"system":"CVSS 2.0 · nvd@nist.gov · Primary","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","score":6.8,"severity":"MEDIUM"}],"references":["https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/","https://support.f5.com/csp/article/K63025104?utm_source=f5support&amp%3Butm_medium=RSS","https://www.oracle.com//security-alerts/cpujul2021.html"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-7160","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-350","CWE-290"],"productCriteria":["cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"],"sourceDates":{"published":"2018-05-17T14:29:00.827","lastModified":"2026-10-08T22:16:47.647"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2018-7160","identifiers":["CVE-2018-7160"]},"retained":false,"historicalAffected":[]}],"coverage":[]}