Node.js CVE-2026-48935

Exploitation requires all of the following: (1) Node.js 26.x prior to v26.3.1 must be installed; (2) the experimental permission model must be explicitly enabled at process startup via the --experimental-permission CLI flag - this is NOT the default Node.js configuration; (3) the attacker must have local system access with at least low-privilege credentials (PR:L per the CVSS vector). The impact is strictly limited to modifying file timestamps (utimes) - file content, network resources, and process state are unaffected (C:N/A:N). Deployments that do not use --experimental-permission are entirely unaffected regardless of Node.js version. The experimental nature of the permission model means that the realistic exploitable population is a small subset of Node.js deployments.

CVSS 3.3 (Low) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately reflects constrained real-world risk. The local attack vector (AV:L) and requirement for at least low-privilege credentials (PR:L) immediately bound the threat surface to authenticated local actors. The integrity impact is narrow - limited to file timestamp manipulation, not content modification - with no confidentiality or availability impact (C:N/A:N). Critically, the permission model must be explicitly opted into via --experimental-permission, which is not the default Node.js runtime configuration; deployments not using this experimental feature are entirely unaffected. No CISA KEV listing exists, no POC code is publicly identified, and EPSS data is unavailable given this is a pre-NVD disclosure. The 'Privilege Escalation' tag in the intelligence data is potentially misleading - this is more accurately a permission-model sandbox bypass for a narrow filesystem operation rather than a classical privilege escalation. Real-world priority is low except for environments deliberately relying on Node.js's experimental permission sandboxing as a security control.

A local attacker with low-privilege credentials on a system running Node.js 26.x with --experimental-permission enabled writes a short script invoking FileHandle.utimes() targeting a sensitive file path outside their permitted write scope. The permission model fails to reject the call, allowing the attacker to alter the file's access and modification timestamps - potentially covering tracks or defeating timestamp-based integrity monitoring. No public POC code has been identified; exploitation requires intentional knowledge of the FileHandle API and the affected Node.js configuration.