CVE-2026-48935: Node.js Permission API File Metadata Bypass

Technical summary

CVE-2026-48935 is an improper permissions enforcement issue in Node.js affecting versions 22, 24, and 26. The Permission API's read-only restrictions, configured via command-line flags such as `--allow-fs-read`, fail to prevent metadata modification operations on protected paths. The vulnerability stems from incomplete validation of file system operations against declared access policies, allowing a local process with limited privileges to invoke system calls or Node.js APIs that modify file attributes without triggering the expected permission denial. The attack surface is constrained to local execution contexts and requires some form of code execution within the Node.js process or a subprocess.

Business impact

Organizations relying on Node.js Permission API to enforce least-privilege isolation between sandboxed application components face degraded security controls. In multi-tenant environments or containerized deployments where Node.js runs untrusted code under restricted permissions, this flaw could allow a compromised module or script to tamper with critical file metadata—potentially causing denial of service, privilege escalation follow-ups, or data integrity violations. The impact is greatest in environments that have adopted Permission API as a core security boundary.

Affected systems

Node.js 22, 24, and 26 across all supported platforms (Linux, macOS, Windows) are affected. Any application or service that spawns Node.js processes with Permission API restrictions—particularly those using `--allow-fs-read`, `--allow-fs-write`, or related flags to enforce file system sandboxing—should be considered at risk. Environments running older, unsupported Node.js versions (20 and earlier) are unaffected by this specific flaw.

Exploitability

Exploitation requires local code execution within or alongside the Node.js process; remote exploitation is not possible. An attacker must either be running code inside the restricted Node.js context or be able to interact with a privileged process running Node.js. The attack does not require user interaction or special system configuration beyond a basic Node.js deployment with Permission API flags enabled. Once code execution is achieved, the Permission API bypass is straightforward to trigger.

Remediation

Update Node.js to patched versions that correct the Permission API enforcement logic. Verify the availability of security updates across your supported release lines (22, 24, 26). Until patches are available and deployed, audit your use of Permission API flags; if they are not critical to your threat model, consider whether the sandboxing they provide justifies the operational overhead. For multi-tenant or untrusted-code scenarios, implement additional OS-level isolation mechanisms (containerization, seccomp, AppArmor, SELinux) rather than relying solely on Node.js Permission API.

Patch guidance

Check the Node.js security advisories and release notes for patched versions of Node.js 22, 24, and 26. Patch versions should be released through the standard Node.js release channels. Apply patches in a staged manner, testing in non-production environments first, especially if your application relies on Permission API flags for security enforcement. Coordinate patching across all Node.js instances in your infrastructure, including development, staging, and production systems.

Detection guidance

Monitor for unexpected file metadata modification operations (chmod, chown, utimes) on paths that should be protected by Permission API restrictions. Enable audit logging at the OS level (auditd on Linux) to capture file system operations and correlate them with Node.js process activity. Review application logs for Permission API denials or warnings. Conduct code reviews of any recent changes to permission-related flags or sandboxing configurations. Test your Permission API policies in a controlled lab environment to confirm they are functioning as intended.

Why prioritize this

Although the CVSS score is LOW (3.3) due to the local-only attack vector and limited impact scope, the vulnerability warrants prompt attention because it directly undermines a security control that organizations have deliberately implemented. The Permission API is typically adopted only when sandboxing is a business or security requirement; any bypass of that control should be treated as a control-effectiveness issue rather than a low-priority bug. Organizations without Permission API in use can deprioritize, but those relying on it should patch within their standard update windows.

Risk score, explained

The CVSS 3.0 score of 3.3 reflects a Low severity rating driven by the local attack vector (AV:L), low complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and limited impact—integrity is affected (I:L) but not confidentiality or availability. The score correctly captures that an attacker already needs local code execution capability. However, in risk-contextualization terms, the actual business risk to organizations that have specifically enabled Permission API for security isolation is materially higher than the base CVSS number suggests, because the flaw breaks an intentional, evaluated security boundary.

Frequently asked questions