Описание
A flaw was found in Node.js. The permission model enforcement, specifically related to process.report functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass the security boundaries designed to protect the system.
Отчет
This flaw allows a local user with execution privileges to write or overwrite arbitrary files outside the configured --allow-fs-write paths by triggering process.report. In a practical scenario, an attacker with local script execution rights could leverage this boundary leak to corrupt configuration files or write diagnostic output to restricted locations writable by the service process.
Red Hat scores this vulnerability at 4.4 (Moderate) with Low Integrity impact (I:L), whereas CVEOrg scores it at 3.3 with no Integrity impact (I:N). Red Hat includes Low Integrity because the ability to overwrite existing files on disk alters file state, even if it cannot bypass underlying operating system permissions or escalate privileges to root. The issue remains bounded strictly to Low Confidentiality and Low Integrity (C:L, I:L, A:N).
Systems and applications that do not actively enable Node.js's experimental Permission Model flag (--experimental-permission), or those running untrusted workloads inside standard operating system isolation primitives (such as Linux containers, cgroups, or dedicated system accounts), are not exposed to additional risk from this flaw.
Меры по смягчению последствий
To mitigate this issue, avoid enabling the experimental Node.js Permission Model by not using the --experimental-permission flag. Additionally, ensure that untrusted Node.js workloads are executed within robust operating system isolation primitives, such as Linux containers or cgroups, to limit potential impact.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | nodejs20 | Will not fix | ||
| Red Hat Hardened Images | nodejs25 | Will not fix | ||
| Red Hat Hardened Images | nodejs26-main-26.5.1-1.5.hum1 | Fixed | RHSA-2026:48273 | 29.07.2026 |
| Red Hat Hardened Images | nodejs22-main-22.23.2-2.3.hum1 | Fixed | RHSA-2026:48305 | 29.07.2026 |
| Red Hat Hardened Images | nodejs24-main-24.18.1-0.1.hum1 | Fixed | RHSA-2026:48537 | 30.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.4 Medium
CVSS3
Связанные уязвимости
(A flaw in Node.js Permission Model enforcement allows process.report w ...)
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
A flaw in Node.js Permission Model enforcement allows process.report w ...
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**.
EPSS
4.4 Medium
CVSS3