{"id":"GHSA-wq4c-wm6x-jw44","revision":"6584c62c1d374b4d9a08bcb22ad091b4","records":[{"revision":"6584c62c1d374b4d9a08bcb22ad091b4","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-wq4c-wm6x-jw44","aliases":["CVE-2018-7160"],"title":"Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding","description":"## Withdrawn Advisory\nThis advisory has been withdrawn because this vulnerability affects inspector code in https://github.com/nodejs/node, not the [legacy debugger](https://nodejs.org/en/docs/inspector#legacy-debugger) at https://github.com/node-inspector/node-inspector. https://github.com/nodejs/node is not in a [supported ecosystem](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems).\n\n## Original Description\nThe Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.","state":2,"publishedAt":"2022-05-13T01:08:23+00:00","modifiedAt":"2026-09-10T03:49:43.2861474+00:00","affected":[{"ecosystem":"npm","name":"node-inspector","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"6.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2018-7160","https://github.com/nodejs/node/commit/e3950d1a402b80e4098a40aacddd6a104da0cfa9","https://nodejs.org/en/blog/vulnerability/march-2018-security-releases","https://support.f5.com/csp/article/K63025104?utm_source=f5support&utm_medium=RSS","https://www.oracle.com//security-alerts/cpujul2021.html"],"sourceUrl":"https://github.com/advisories/GHSA-wq4c-wm6x-jw44","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wq4c-wm6x-jw44","identifiers":["GHSA-wq4c-wm6x-jw44","CVE-2018-7160"]},"retained":false,"historicalAffected":[]}],"coverage":[]}