Every CVE Search/ Get API key

CVE-2023-45311

Code injection in fsevents

9.8 CriticalFix available

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.70%Up 1.7 points since Oct 7, 2023
90%50%10%1%

What each source reports

NVD Score used 9.8

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.

Record
CVE-2023-45311
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
CVE List No score

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.

Record
CVE-2023-45311
Updated
2026-11-02
EUVDEUVD-2023-2701 No score

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.

Record
EUVD-2023-2701
Updated
2026-11-03
GitHub AdvisoriesGHSA-8r6j-v8pm-fqw3 9.8

Code injection in fsevents

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary.

Record
GHSA-8r6j-v8pm-fqw3
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSVGHSA-8r6j-v8pm-fqw3 9.8

Code injection in fsevents

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary.

Record
GHSA-8r6j-v8pm-fqw3
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSVUBUNTU-CVE-2023-45311 9.8

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.

Record
UBUNTU-CVE-2023-45311
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV No score

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.

Record
CVE-2023-45311
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fsevents
npm
through 1.2.10
1.2.11
fsevents
npm
before 1.2.11
1.2.11
npm
Ubuntu:14.04:LTS
All versions, plus listed versions
1.2.18~dfsg-31.3.10~dfsg-1
None known
npm
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
1.4.21+ds-23.5.2-0ubuntu43.5.2-0ubuntu4.1.16.04.1~esm1
None known
npm
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
3.5.2-0ubuntu43.5.2-0ubuntu4.1.18.04.1~esm1
None known
qtwebengine-opensource-src
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
5.9.1+dfsg-45.9.1+dfsg-4ubuntu15.9.2+dfsg-2ubuntu15.9.3+dfsg-0ubuntu15.9.4+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2+esm1
None known
npm
Ubuntu:20.04:LTS
All versions, plus listed versions
5.8.0+ds6-46.14.4+ds-1ubuntu2
None known
qtwebengine-opensource-src
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
5.12.4+dfsg-1ubuntu15.12.4+dfsg-1ubuntu35.12.5+dfsg-3ubuntu15.12.5+dfsg-6ubuntu25.12.5+dfsg-7
Show 4 moreShow less
5.12.5+dfsg-7build15.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu1.15.12.8+dfsg-0ubuntu1.1+esm1
None known
npm
Ubuntu:22.04:LTS
All versions, plus listed versions
7.5.2+ds-27.24.2+ds-17.24.2+ds-28.3.0~ds-18.3.0~ds-28.3.2~ds-18.5.0~ds-18.5.1~ds-1
None known
qtwebengine-opensource-src
Ubuntu:Pro:22.04:LTS
All versions, plus listed versions
5.15.6+dfsg-15.15.6+dfsg-25.15.7+dfsg-25.15.8+dfsg-15.15.8+dfsg-1build1
Show 4 moreShow less
5.15.8+dfsg-1build25.15.8+dfsg-25.15.9+dfsg-15.15.9+dfsg-1ubuntu0.1~esm1
None known
Show 8 moreShow less
Affected packages
PackageAffectedFixed
npm
Ubuntu:24.04:LTS
All versions, plus listed versions
9.2.0~ds1-19.2.0~ds1-2
None known
qtwebengine-opensource-src
Ubuntu:Pro:24.04:LTS
All versions, plus listed versions
5.15.15+dfsg-25.15.15+dfsg-2build25.15.15+dfsg-2ubuntu15.15.16+dfsg-15.15.16+dfsg-1ubuntu25.15.16+dfsg-1ubuntu45.15.16+dfsg-35.15.16+dfsg-3ubuntu0.1~esm1
None known
npm
Ubuntu:25.10
All versions, plus listed versions
9.2.0~ds1-3
None known
qtwebengine-opensource-src
Ubuntu:25.10
All versions, plus listed versions
5.15.18+dfsg-25.15.18+dfsg-2build15.15.19+dfsg-15.15.19+dfsg2-1
None known
npm
Ubuntu:26.10
All versions, plus listed versions
9.2.0~ds3-111.16.0+ds2-4
None known
qtwebengine-opensource-src
Ubuntu:26.10
All versions, plus listed versions
5.15.19+dfsg2-45.15.19+dfsg2-65.15.19+dfsg2-7
None known
npm
Ubuntu:26.04:LTS
All versions, plus listed versions
9.2.0~ds1-39.2.0~ds2-29.2.0~ds3-1
None known
qtwebengine-opensource-src
Ubuntu:Pro:26.04:LTS
All versions, plus listed versions
5.15.19+dfsg2-15.15.19+dfsg2-1build15.15.19+dfsg2-25.15.19+dfsg2-35.15.19+dfsg2-45.15.19+dfsg2-4ubuntu0.1~esm1
None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-45311 is a critical vulnerability (CVSS 9.8) in Fsevents Project Fsevents, published October 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.70%, the 77th percentile. Fixed in fsevents 1.2.11.

References

Show 9 moreShow less
MoveEnter Open