THREATOPS
THREAT OPSThreat News › [NVD] CVE-2026-21715 (LOW 3.3) — A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs

[NVD] CVE-2026-21715 (LOW 3.3) — A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs

lownvdPublished 2026-03-30

CVE-2026-21715 CVSS: 3.3 LOW Published: 2026-03-30T20:16:19.703

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.

As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to chec

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-21715