PT-2026-122151
CVE-2026-106073
·
تاريخ النشر
2026-10-23
·
تاريخ التحديث
2026-10-23
الوصف من
CVSS 3.1
3.3
منخفضةالمقاييسAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
A flaw in Node.js Permission Model filesystem enforcement leaves
fs.realpathSync() without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native().As a result, code running under
--permission with restricted --allow-fs-read can still use fs.realpathSync() to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.This vulnerability affects Node.js 26.x, 24.x, and 22.x.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾