EUVD-2026-39608
GHSA-9qm6-cjgc-f64v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Local-only exploitation (AV:L) requiring low-privilege credentials (PR:L); impact strictly limited to file timestamp modification (I:L) with no content, confidentiality, or availability effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
Node.js permission model bypass via FileHandle.utimes() allows local low-privilege users to modify file timestamps on paths outside their permitted write scope. Affecting Node.js 26.x before v26.3.1, this flaw is only exploitable when the experimental permission model is explicitly enabled via --experimental-permission, substantially limiting exposure. No public exploit code or active exploitation has been identified at time of analysis, and the vendor-released patch (v26.3.1) is confirmed available as of 2026-06-18.
Technical ContextAI
Node.js includes an experimental permission model, activated via the --experimental-permission CLI flag, designed to sandbox filesystem, network, and process access for running scripts. The fs/promises API exposes FileHandle.utimes(), which modifies the access and modification timestamps of an open file descriptor. CVE-2026-48935 (rated Low by the Node.js team) reveals that the permission model's write-scope enforcement did not gate FileHandle.utimes() calls, allowing this specific syscall to bypass the sandbox. CWE-276 (Incorrect Default Permissions) captures the root cause: an operation with potential integrity impact was omitted from the permission model's access-control surface. The fix, authored by RafaelGSS in the Node.js 26.x Current channel, explicitly disables FileHandle.utimes() when the permission model is active.
RemediationAI
Upgrade Node.js to version 26.3.1 or later; this is the vendor-confirmed patched release per https://github.com/nodejs/node/releases/tag/v26.3.1 and https://nodejs.org/en/blog/vulnerability/june-2026-security-releases. The fix authored by RafaelGSS explicitly disables FileHandle.utimes() when the permission model is active. As a compensating control prior to patching, avoid relying on Node.js's --experimental-permission flag as a security boundary for timestamp-sensitive files; instead enforce OS-level file permissions (chmod/chown) which remain unaffected by this bypass. Note that the permission model is experimental and not enabled by default, so deployments not using --experimental-permission require no remediation action for this specific CVE.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today