EUVD-2026-17180CVSS VectorNVD
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
5DescriptionNVD
An incomplete fix for CVE-2024-36137 leaves FileHandle.chmod() and FileHandle.chown() in the promises API without the required permission checks, while their callback-based equivalents (fs.fchmod(), fs.fchown()) were correctly patched.
As a result, code running under --permission with restricted --allow-fs-write can still use promise-based FileHandle methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.
This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model where --allow-fs-write is intentionally restricted.
AnalysisAI
Node.js Permission Model bypass in FileHandle.chmod() and FileHandle.chown() promise-based methods allows local authenticated users with restricted --allow-fs-write to modify file permissions and ownership on already-open file descriptors, circumventing intended write restrictions. The vulnerability affects Node.js 20.x, 22.x, 24.x, and 25.x when running under the --permission flag; the callback-based equivalents (fs.fchmod, fs.fchown) were correctly patched in CVE-2024-36137, but the promises API was incompletely fixed. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Vendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | needs-triage | - |
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| questing | needs-triage | - |
| upstream | released | 22.22.2+dfsg+~cs22.19.15-1 |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 12.22.12~dfsg-1~deb11u4 | - |
| bullseye (security) | vulnerable | 12.22.12~dfsg-1~deb11u7 | - |
| bookworm, bookworm (security) | vulnerable | 18.20.4+dfsg-1~deb12u1 | - |
| trixie | fixed | 20.19.2+dfsg-1+deb13u2 | - |
| trixie (security) | fixed | 20.19.2+dfsg-1+deb13u2 | - |
| forky | vulnerable | 22.22.1+dfsg+~cs22.19.15-1 | - |
| sid | fixed | 22.22.2+dfsg+~cs22.19.15-1 | - |
| (unstable) | fixed | 22.22.2+dfsg+~cs22.19.15-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today