Riskcovery

CVE-2026-21715

State
Published
Severity
3.3 Low
Published
Mar 30, 2026
Updated
Sep 17, 2026
Reserved
Jan 4, 2026

Read the record on cve.org

Description

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.

Scores

CVSSScoreVectorSource
3.03.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nhackerone

Weaknesses

  • CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

ProductVersions
nodenodejs
  • 20.20.1 through 20.20.1Affected
  • 22.22.1 through 22.22.1Affected
  • 24.14.0 through 24.14.0Affected
  • 25.8.1 through 25.8.1Affected
  • 4.0 to before 4.*Affected
  • 5.0 to before 5.*Affected
  • 6.0 to before 6.*Affected
  • 7.0 to before 7.*Affected
  • 8.0 to before 8.*Affected
  • 9.0 to before 9.*Affected
  • 10.0 to before 10.*Affected
  • 11.0 to before 11.*Affected
  • 12.0 to before 12.*Affected
  • 13.0 to before 13.*Affected
  • 14.0 to before 14.*Affected
  • 15.0 to before 15.*Affected
  • 16.0 to before 16.*Affected
  • 17.0 to before 17.*Affected
  • 18.0 to before 18.*Affected
  • 19.0 to before 19.*Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.