THREAT OPS › Threat News › [NVD] CVE-2026-21715 (LOW 3.3) — A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.
As a result, code running under `--permission` with restricted `--allow-fs
[NVD] CVE-2026-21715 (LOW 3.3) — A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs
CVE-2026-21715 CVSS: 3.3 LOW Published: 2026-03-30T20:16:19.703
A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them.
As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to chec
Indicators of compromise
- CVE-2026-21715cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-21715