EUVD-2026-109098
GHSA-w63p-v5c6-3pmw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRun partially-trusted JS in --permission process
-
ExploitCall realpathSync outside allowed scope
-
ExecutionBypass permission model path check
-
ImpactDisclose filesystem paths beyond restriction
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to be running with the experimental Node.js Permission Model enabled (the --permission flag, or --experimental-permission in older releases); without it there is no filesystem restriction for realpathSync to bypass. The attacker must additionally be able to execute JavaScript within that permission-restricted Node.js process (hence local vector and PR:L) - for example partially-trusted plugin, template, or sandboxed code. Limiting factors: default Node.js deployments do not enable the Permission Model and are unaffected; impact is confined to confidentiality (path resolution leakage), with no integrity or availability effect, and no remote network vector. |
| Impact | This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor-assigned CVSS 3.0 score is 3.3 (Low) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N: local attack vector, low privileges required (attacker must already be executing code inside the Node.js process), no user interaction, unchanged scope, and only low confidentiality impact with no integrity or availability impact. CWE-284 (Improper Access Control) matches the fix summary: 'permission: check permission model in realpathSync'. The vuln.today decision label is 'monitor', the issue is rated 'Low' in the Node.js release notes, and it is not listed in CISA KEV. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. A PoC reference (a GitHub gist) is listed but is not verified as working exploit code, so it should not be treated as a weaponized exploit. The practical risk is bounded sharply by the fact that this only matters when the experimental Node.js Permission Model is enabled; in the default configuration (no Permission Model), there is no restriction to bypass and no impact. Net assessment: a real but minor hardening fix, not an emergency. |
| Exploit ScenarioDerived | An application runs Node.js with the experimental Permission Model enabled to restrict filesystem access for partially-trusted code (for example a plugin, template, or sandboxed script). That code calls realpathSync, which prior to the fix did not consult the permission model, allowing it to resolve paths that the permission model should have blocked and thereby learn information about files outside its allowed scope. A public PoC reference exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 23, 2026
Node.js's experimental Permission Model can be bypassed in fs.realpathSync, letting JavaScript already running inside a permission-restricted process resolve filesystem paths that fall outside the granted scope and infer information about them. The flaw is local and low severity (assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N): it only matters when the process was started with the --permission flag (or --experimental-permission in older releases) and the attacker can execute code inside that process, such as partially trusted plugin, template or sandboxed code; default Node.js deployments without the Permission Model are unaffected, and there is no integrity or availability impact. It is fixed in the 26.12.1 security release (2026-10-21) and is rated 'Low' in the vendor's own list of fixes; a public PoC reference exists as a GitHub gist but is not verified as working exploit code, no active exploitation is confirmed, and priority is monitor.
RemediationAI
Apply the vendor security release: Node.js 26.12.1 (2026-10-21) contains the fix for CVE-2026-106073, per https://github.com/nodejs/node/releases/tag/v26.12.1; the October 2026 advisory at https://nodejs.org/en/blog/vulnerability/october-2026-security-releases should be consulted for the corresponding patched releases on the 22.x and 24.x lines, since the supplied data lists those branches as affected up to 22.23.3 and 24.22.0 but does not enumerate their fixed versions. If upgrading immediately is not possible, note that exposure requires the Permission Model to be enabled and attacker-controlled JavaScript to run inside that restricted process, so the practical interim control is to stop executing partially trusted plugin, template or sandboxed code inside --permission processes and confine such workloads with OS-level isolation (container or VM boundary) instead - with the trade-off that the Permission Model itself then provides no protection, and that it is experimental and received multiple access-control fixes in this same release, so it should not be treated as a sole security boundary. Because impact is limited to path-resolution information disclosure (C:L, I:N, A:N), no emergency change is warranted, but the upgrade should be folded into normal Node.js release tracking.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue sits in Node.js's Permission Model, the experimental access-control layer enabled with the --permission flag (--experimental-permission in older lines) that restricts filesystem, child process, worker and addon operations for a running process. CWE-284 (Improper Access Control) describes the root cause: the permission check was missing from the realpathSync path-resolution code path, so an operation that canonicalises symlinks and returns absolute paths was not gated the same way as other fs operations. Because realpathSync resolves and reveals canonical paths, the gap is an information-exposure/scope-leak rather than a write or execution primitive, which is consistent with the supplied vector's confidentiality-only impact (C:L, I:N, A:N) and its local attack vector with low privileges (AV:L/PR:L) - the attacker must already be able to run JavaScript inside the permission-restricted process. The release notes list the fix simply as 'permission: check permission model in realpathSync (RafaelGSS) - Low'; the underlying commit is not enumerated in the supplied data, and no CPE strings were provided, so affected identification relies on the EUVD version ranges for the 22.x, 24.x and 26.x release lines. Notably, the same release carries several other permission/fs and TLS/DNS fixes, underscoring that the Permission Model is still experimental hardening territory rather than a mature security boundary.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attacker must run code inside a permission-restricted Node process (AV:L, PR:L); realpathSync skipping the permission check leaks path info (C:L) with no integrity or availability impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB