AIKIDO-2026-28531

TL;DR

Affected versions of the package allow a permissions bypass in the Node.js Permission Model, where filesystem path matching can over-grant access across radix-tree prefix boundaries. Under --permission, when multiple allowlisted paths share a common prefix, a radix-tree node split can incorrectly mark an intermediate prefix as granted. An attacker who is allowed access to one path can then read from or write to sibling paths outside the intended filesystem allowlist. The fix only preserves leaf grants on split nodes that were already end nodes.