What is the CVSS score of EUVD-2026-39608?

EUVD-2026-39608 has a CVSS 3.0 base score of 3.3 (Low). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-39608?

Yes, a patch is available for EUVD-2026-39608. Update the affected software to the latest version immediately.

Node.js EUVD-2026-39608

| CVE-2026-48935 LOW

Incorrect Default Permissions (CWE-276)

2026-06-18

GHSA-9qm6-cjgc-f64v

Privilege Escalation Node.js Node Js

3.3

CVSS 3.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.3 LOW

Local-only exploitation (AV:L) requiring low-privilege credentials (PR:L); impact strictly limited to file timestamp modification (I:L) with no content, confidentiality, or availability effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 26, 2026 - 02:26 vuln.today

Analysis Generated

Jun 26, 2026 - 02:26 vuln.today

CVSS changed

Jun 26, 2026 - 02:22 NVD

3.3 (LOW)

CVE Published

Jun 18, 2026 - 04:37 github-releases

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

Node.js permission model bypass via FileHandle.utimes() allows local low-privilege users to modify file timestamps on paths outside their permitted write scope. Affecting Node.js 26.x before v26.3.1, this flaw is only exploitable when the experimental permission model is explicitly enabled via --experimental-permission, substantially limiting exposure. No public exploit code or active exploitation has been identified at time of analysis, and the vendor-released patch (v26.3.1) is confirmed available as of 2026-06-18.

Technical ContextAI

Node.js includes an experimental permission model, activated via the --experimental-permission CLI flag, designed to sandbox filesystem, network, and process access for running scripts. The fs/promises API exposes FileHandle.utimes(), which modifies the access and modification timestamps of an open file descriptor. CVE-2026-48935 (rated Low by the Node.js team) reveals that the permission model's write-scope enforcement did not gate FileHandle.utimes() calls, allowing this specific syscall to bypass the sandbox. CWE-276 (Incorrect Default Permissions) captures the root cause: an operation with potential integrity impact was omitted from the permission model's access-control surface. The fix, authored by RafaelGSS in the Node.js 26.x Current channel, explicitly disables FileHandle.utimes() when the permission model is active.

RemediationAI

Upgrade Node.js to version 26.3.1 or later; this is the vendor-confirmed patched release per https://github.com/nodejs/node/releases/tag/v26.3.1 and https://nodejs.org/en/blog/vulnerability/june-2026-security-releases. The fix authored by RafaelGSS explicitly disables FileHandle.utimes() when the permission model is active. As a compensating control prior to patching, avoid relying on Node.js's --experimental-permission flag as a security boundary for timestamp-sensitive files; instead enforce OS-level file permissions (chmod/chown) which remain unaffected by this bypass. Note that the permission model is experimental and not enabled by default, so deployments not using --experimental-permission require no remediation action for this specific CVE.