What is the CVSS score of CVE-2026-48936?

CVE-2026-48936 has a CVSS 3.0 base score of 3.3 (Low). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-48936?

Yes, a patch is available for CVE-2026-48936. Update the affected software to the latest version immediately.

Node.js Permission Model CVE-2026-48936

EUVD-2026-39611 LOW

Improper Access Control (CWE-284)

2026-06-18

GHSA-hwhp-f859-r728

Authentication Bypass Node.js Node Js

3.3

CVSS 3.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.3 LOW

Local vector (AV:L) and low privileges (PR:L) required since attacker must execute code inside an opt-in permission-sandboxed Node.js process; only integrity is impacted.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 26, 2026 - 02:26 vuln.today

Analysis Generated

Jun 26, 2026 - 02:26 vuln.today

CVSS changed

Jun 26, 2026 - 02:22 NVD

3.3 (LOW)

CVE Published

Jun 18, 2026 - 04:37 github-releases

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

Node.js Permission Model fails to apply net scope guards to pipe open and chmod operations, enabling a local authenticated user to bypass intended access control boundaries enforced by the experimental Permission Model. Affected is Node.js v26.x prior to v26.3.1 (Current release line), disclosed in the June 2026 security release. Rated Low severity by the Node.js team; no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

Node.js includes an experimental Permission Model (enabled via --permission flag with scoped allow-lists such as --allow-net, --allow-fs-read, --allow-fs-write) designed to restrict what system resources a process may access at runtime. CWE-284 (Improper Access Control) describes the root cause: the permission enforcement logic did not consistently apply net-scope validation when a process attempted to open named pipes or invoke chmod. Because pipes can bridge process boundaries and chmod affects file metadata including access modes on network-accessible paths, the missing guard in these code paths created a bypass surface within the permission sandbox. The fix, authored by RafaelGSS (commit 98fbc... area, v26.3.1 release), adds the missing net-scope checks to these operations. The affected CPE is the Node.js 26.x Current release line prior to 26.3.1.

RemediationAI

Upgrade to Node.js v26.3.1 (Current), the vendor-released patch, available at https://github.com/nodejs/node/releases/tag/v26.3.1 and https://nodejs.org/en/blog/vulnerability/june-2026-security-releases. This is the primary and recommended fix. If immediate upgrade is not feasible and your deployment relies on the Permission Model for sandboxing, a compensating control is to avoid granting net scope in conjunction with workloads that open named pipes or invoke chmod - though this may break legitimate application functionality. Alternatively, if the Permission Model is used purely for file-system sandboxing without net-scope restrictions, the impact of this bypass is reduced. Note that the Permission Model remains experimental in Node.js v26 and should not be treated as the sole security boundary in high-assurance environments regardless of this fix.