CVE-2026-58039 PUBLISHED

Assigner: hackerone
Reserved: 27.06.2026 Published: 31.07.2026 Updated: 31.07.2026

A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.

This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.

This vulnerability affects Node.js 22.x, 24.x, and 26.x.

Metrics

CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 3.3

Product Status

Vendor nodejs
Product node
Versions Default: unaffected
  • affected from 26.5.0 to 26.5.0 (incl.)
  • affected from 24.18.0 to 24.18.0 (incl.)
  • affected from 22.23.1 to 22.23.1 (incl.)

References

Problem Types

  • CWE-284 Improper Access Control - Generic CWE