CVE-2023-30581 (published 2023-11-22T23:28:30.768Z)
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20.

Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js
Affected products: Vendor: Node.js
Product: Node.js
Versions: 16.20.1, 18.16.1, 20.3.1