AIKIDO-2026-372565
node is vulnerable to Improper Access Control
30
Low Risk
This Affects:
nodeTL;DR
Affected versions of the package allow a permissions bypass in the Node.js Permission Model, where process.report can write and overwrite files outside --allow-fs-write paths. Permission checks were applied against the current working directory or an incomplete path rather than the final report output path (including process.report.directory), so setting the report directory to a denied location still succeeded. This breaks the intended filesystem allowlist boundary and can lead to unauthorized writes or overwrites under --permission.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and run Node.js with the Permission Model (--permission) enabled.
Background info
node is vulnerable to Improper Access Control in versions 25.0.0 - 26.5.0, 23.0.0 - 24.18.0 and 0.0.1 - 22.23.1.
How to fix this
Upgrade the node library to a patch version.
Links
nodejs.org/en/blog/vulnerability/july-2026-security-releases#permission-model-allows-process-reports-to-write-outside-the-allowlist-cve-2026-58039---lownodejs.org/en/blog/vulnerability
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant