643 matches found
CVE-2026-21636
CVE-2026-21636 - Node.js Permission Model UDS/Network Bypass Vulnerability summary The Node.js permission model --permission is designed to sandbox a process by restricting access to the filesystem, child processes, workers, and network. CVE-2026-21636 reveals that connections made via undici/fet...
CVE-2026-106073
A flaw was found in the Node.js Permission Model. fs.realpathSync does not perform the filesystem read permission checks required of comparable fs APIs. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. Code running under --permission with restricted...
CVE-2026-106071
A flaw was found in the Node.js Permission Model. Wildcard --allow-fs-read or --allow-fs-write rules can grant access to paths that do not match the intended wildcard when the requested path is shorter than the wildcard prefix and the radix-tree lookup stops comparing early. For example,...
Exploit for CVE-2026-106071
node-cve-2026-106071-check Standalon...
Exploit for CVE-2026-58039
node-cve-2026-58039-check Standalone...
AZL-111023 CVE-2026-106071 affecting package nodejs 24.21.0-1
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a...
ALPINE-CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
ALPINE-CVE-2026-106071
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a...
AZL-111032 CVE-2026-106073 affecting package nodejs 24.21.0-1
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
DEBIAN-CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
CVE-2026-106071
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a...
CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
EUVD-2026-109098
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...
CVE-2026-106071
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard "--allow-fs-read" or "--allow-fs-write" rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as...
EUVD-2026-109103
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a...
CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves "fs.realpathSync" without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered "fs.realpathSync.native". As a result, code running under "--permission" with restricted "--allow-fs-read...
CVE-2026-106071
A flaw in the Node.js Permission Model filesystem enforcement allows for over-granting of access to paths that do not match the intended wildcard --allow-fs-read or --allow-fs-write rules. This occurs because the radix tree lookup stops comparing early when a requested path is shorter than the pr...
CVE-2026-106071
A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard --allow-fs-read or --allow-fs-write rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a...
CVE-2026-106073
A flaw in the Node.js Permission Model filesystem enforcement allows the fs.realpathSync() function to bypass required read permission checks. This is an incomplete fix for CVE-2026-21715 , which only addressed fs.realpathSync.native(). Consequently, code executing under the --permission flag wit...
CVE-2026-106073
A flaw in Node.js Permission Model filesystem enforcement leaves fs.realpathSync without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.native. As a result, code running under --permission with restricted --allow-fs-read can...