Executive Summary

This vulnerability is due to an incomplete fix for a previous issue (CVE-2024-36137) in Node.js. Specifically, the promise-based methods FileHandle.chmod() and FileHandle.chown() do not perform the required permission checks. While the callback-based equivalents (fs.fchmod() and fs.fchown()) were correctly patched, the promise-based methods allow code running with restricted file system write permissions (--allow-fs-write) to still modify file permissions and ownership on already-open file descriptors. This effectively bypasses the intended write restrictions.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an attacker or malicious code running with limited permissions can escalate their ability to modify file permissions and ownership. This means they can change access controls on files even when write permissions are supposed to be restricted, potentially leading to unauthorized file modifications or privilege escalation within the affected Node.js processes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows bypassing intended write restrictions on file permissions and ownership in Node.js processes using the Permission Model with restricted file system write permissions.

Such unauthorized modification capabilities could potentially lead to unauthorized changes in file system permissions and ownership, which may impact the security controls required for compliance with standards like GDPR and HIPAA.

However, the provided information does not explicitly describe the direct impact on compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that you do not rely solely on the promises API methods FileHandle.chmod() and FileHandle.chown() for permission checks, as they lack the required enforcement.

Restrict or avoid using the affected Node.js versions 20.x, 22.x, 24.x, and 25.x with the Permission Model where --allow-fs-write is restricted until a proper patch is applied.

Monitor for updates or patches from Node.js that address this incomplete fix and apply them promptly.

Useful 0 Not Useful 0