CVE-2026-48935

LOW3.3

A flaw in Node

Published Jun 26, 2026

Modified 2 weeks ago

Details

A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. --allow-fs-read.

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

Affected Packages

Node.js

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1703)Windows 10 (1709)Windows 10 (1803)

References

CVSS Analysis

CVSS v3.0

3.3

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

LowI:L

Availability

NoneA:N

3.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness Type (CWE)

Configuration

Ecosystems(22)

Timeline

PublishedJun 26, 2026

ModifiedJun 26, 2026