PT-2026-28319 · Node.Js+1 · Node.Js+1
Stif
·
Publicado
2026-01-01
·
Atualizado
2026-04-21
·
CVE-2026-21715
CVSS v3.1
3.3
Baixa
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Node.js versions 20.x through 25.x
Description
A flaw exists in the Node.js Permission Model's filesystem enforcement, specifically leaving the
fs.realpathSync.native() function without the necessary read permission checks. Comparable filesystem functions correctly enforce these checks. Consequently, code operating under the --permission flag with restricted --allow-fs-read can still utilize fs.realpathSync.native() to verify file existence, resolve symbolic link targets, and list filesystem paths outside of authorized directories. The vulnerable function is fs.realpathSync.native(). The affected API endpoint is not explicitly mentioned.Recommendations
Versions 20.x through 25.x are affected and require mitigation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Information Disclosure
Incorrect Permission
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Node.Js
Rocky Linux