CVE-2026-48935

{
  "id": "CVE-2026-48935",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-26T02:16:53.050",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**."
    },
    {
      "lang": "es",
      "value": "Un fallo en la API de Permisos de Node.js puede provocar que los metadatos de un archivo se modifiquen incluso en una ruta que se configuró como de solo lectura con, por ejemplo, “--allow-fs-read”.\n\nEsta vulnerabilidad afecta a todas las líneas de lanzamiento compatibles: Node.js 22, Node.js 24, y Node.js 26."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nodejs",
          "product": "node",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "22.22.3",
              "lessThanOrEqual": "22.22.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "24.16.0",
              "lessThanOrEqual": "24.16.0",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "26.3.0",
              "lessThanOrEqual": "26.3.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-26T15:04:33.702023Z",
          "id": "CVE-2026-48935",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nodejs:node.js:22.22.3:*:*:*:-:*:*:*",
              "matchCriteriaId": "3C0C5080-5F99-4651-9855-2DE03C9070C5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nodejs:node.js:24.16.0:*:*:*:-:*:*:*",
              "matchCriteriaId": "3B912C84-1AA5-4D74-AB1A-64162C80A33B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nodejs:node.js:26.3.0:*:*:*:-:*:*:*",
              "matchCriteriaId": "8152ACE6-3CAF-4CA0-8B19-D4753811EB44"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}