CVE-2026-21715

描述

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-read` is intentionally restricted.

如何修補 CVE-2026-21715

要修補 CVE-2026-21715,請將受影響套件升級到下列已修補版本。

• —升級至 22.22.2-r0 或更新版本
• —升級至 20.20.2 或更新版本
• —升級至 20.20.2 或更新版本
• —升級至 20.19.2+dfsg-1+deb13u2 或更新版本

CVE-2026-21715 正在被利用嗎?

低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• from 0, < 22.22.2-r0
• from 0, < 20.20.2, >= 21.0.0, < 22.22.2, >= 23.0.0, < 24.14.1, >= 25.0.0, < 25.8.2
• from 0, < 20.20.2, >= 21.0.0, < 22.22.2, >= 23.0.0, < 24.14.1, >= 25.0.0, < 25.8.2
• from 0, < 20.19.2+dfsg-1+deb13u2

CVSS 分數

參考連結(4)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-21715
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2026-21715
• WEBnodejs.org/en/blog/vulnerability/march-2026-security-releases
• WEBnvd.nist.gov/vuln/detail/CVE-2026-21715