THREAT OPS › Threat News › [NVD] CVE-2026-21716 (LOW 3.3) — An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.
As a result, code running under `
[NVD] CVE-2026-21716 (LOW 3.3) — An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `
CVE-2026-21716 CVSS: 3.3 LOW Published: 2026-03-30T20:16:19.873
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.
As a result, code running under `--permission` with restricted `--allow-fs-write` can st
Indicators of compromise
- CVE-2026-21716cve
- CVE-2024-36137cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-21716