CVE-2026-21716

An incomplete fix for CVE-2024-36137 leaves "FileHandle.chmod" and "FileHandle.chown" in the promises API without the required permission checks, while their callback-based equivalents "fs.fchmod", "fs.fchown" were correctly patched. As a result, code running under "--permission" with restricted...