EUVD-2026-51369
GHSA-4qw5-6jhx-9hfx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local vector confirmed by permission model context; PR:L as attacker needs existing process execution; C:L only since report content may expose process state; no integrity or availability impact identified.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
The Node.js permission model fails to validate the final resolved output path when generating diagnostic reports via process.report, allowing a local low-privileged attacker to write report files to filesystem locations outside the paths explicitly permitted by the --allow-fs-write flag. Affected are Node.js 26.x through 26.5.0, 24.x through 24.18.0, and 22.x through 22.23.1 (confirmed via EUVD-2026-51369). No public exploit code exists and no active exploitation has been confirmed; the fix is available in Node.js 26.5.1 released 2026-07-29.
Technical ContextAI
Node.js introduced an experimental permission model (activated via the --permission or --experimental-permission CLI flag) that restricts process access to filesystem paths, environment variables, child processes, and other OS resources. The --allow-fs-write flag controls which filesystem paths a process may write to. CVE-2026-58039 is rooted in CWE-284 (Improper Access Control): the permission enforcement code for diagnostic report output did not resolve the final canonical path before comparing it against the write-permission allowlist. The commit 'permission: check final report output path' by RafaelGSS indicates that path resolution (e.g., symbolic link traversal, relative path normalization, or radix-trie node splitting) occurred after the permission check rather than before, creating a TOCTOU-style bypass window. This is consistent with related permission-model fixes in the same release (CVE-2026-58043: 'avoid granting radix split nodes'; CVE-2026-56847: 'enforce fs write permission for trace events'), suggesting a systemic audit of path resolution ordering across the permission subsystem.
RemediationAI
Upgrade to Node.js 26.5.1 or the corresponding patched LTS releases for the 24.x and 22.x lines; exact patch versions for those lines should be confirmed via the Node.js security blog at https://nodejs.org/en/blog/vulnerability, as only the 26.5.1 Current release tag is confirmed in the available data. As a compensating control where immediate upgrade is not feasible, disable diagnostic report generation entirely using the --no-report CLI flag if the application does not depend on process.report - this removes the vulnerable code path with no functional impact for most workloads. Alternatively, avoid passing user-controlled or externally-influenced values as the report output path in permission-model-restricted processes. Note that removing the --permission flag entirely eliminates the exploit surface but also removes all permission model protections, which may not be acceptable in hardened environments.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today