{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58039", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-06-27T15:00:00.779Z", "datePublished": "2026-07-31T00:18:49.050Z", "dateUpdated": "2026-07-31T16:01:49.630Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**."}], "affected": [{"defaultStatus": "unaffected", "vendor": "nodejs", "product": "node", "versions": [{"version": "26.5.0", "status": "affected", "lessThanOrEqual": "26.5.0", "versionType": "semver"}, {"version": "24.18.0", "status": "affected", "lessThanOrEqual": "24.18.0", "versionType": "semver"}, {"version": "22.23.1", "status": "affected", "lessThanOrEqual": "22.23.1", "versionType": "semver"}]}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 3.3, "baseSeverity": "LOW"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control - Generic"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-07-31T00:18:49.050Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-31T16:00:31.468676Z", "id": "CVE-2026-58039", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T16:01:49.630Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58039", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T16:00:31.468676Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T16:01:45.499Z"}}], "cna": {"metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "nodejs", "product": "node", "versions": [{"status": "affected", "version": "26.5.0", "versionType": "semver", "lessThanOrEqual": "26.5.0"}, {"status": "affected", "version": "24.18.0", "versionType": "semver", "lessThanOrEqual": "24.18.0"}, {"status": "affected", "version": "22.23.1", "versionType": "semver", "lessThanOrEqual": "22.23.1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://nodejs.org/en/blog/vulnerability"}], "descriptions": [{"lang": "en", "value": "A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control - Generic"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-07-31T00:18:49.050Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58039", "state": "PUBLISHED", "dateUpdated": "2026-07-31T16:01:49.630Z", "dateReserved": "2026-06-27T15:00:00.779Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-07-31T00:18:49.050Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "node", "vendor": "nodejs", "versions": [{"lessThanOrEqual": "26.5.0", "status": "affected", "version": "26.5.0", "versionType": "semver"}, {"lessThanOrEqual": "24.18.0", "status": "affected", "version": "24.18.0", "versionType": "semver"}, {"lessThanOrEqual": "22.23.1", "status": "affected", "version": "22.23.1", "versionType": "semver"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.\n\nThis can lead to confidentiality impact or bypass of the intended security boundary under affected configurations.\n\nThis vulnerability affects Node.js **22.x**, **24.x**, and **26.x**."}], "id": "CVE-2026-58039", "lastModified": "2026-07-31T16:17:08.120", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "[email protected]", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58039", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-31T16:00:31.468676Z", "version": "2.0.3"}}]}, "published": "2026-07-31T01:16:31.530", "references": [{"source": "[email protected]", "url": "https://nodejs.org/en/blog/vulnerability"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "[email protected]", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:48273", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "nodejs26-main-26.5.1-1.5.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-29T00:00:00Z"}, {"advisory": "RHSA-2026:48305", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "nodejs22-main-22.23.2-2.3.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-29T00:00:00Z"}, {"advisory": "RHSA-2026:48537", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "nodejs24-main-24.18.1-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-30T00:00:00Z"}], "bugzilla": {"description": "nodejs: Information disclosure due to improper permission enforcement", "id": "2509653", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509653"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "verified"}, "cwe": "CWE-73", "details": ["A flaw was found in Node.js. The permission model enforcement, specifically related to `process.report` functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass the security boundaries designed to protect the system."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, avoid enabling the experimental Node.js Permission Model by not using the `--experimental-permission` flag. Additionally, ensure that untrusted Node.js workloads are executed within robust operating system isolation primitives, such as Linux containers or cgroups, to limit potential impact."}, "name": "CVE-2026-58039", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "nodejs20", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "nodejs25", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-31T00:18:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-58039\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-58039\nhttps://nodejs.org/en/blog/vulnerability"], "statement": "This flaw allows a local user with execution privileges to write or overwrite arbitrary files outside the configured `--allow-fs-write` paths by triggering `process.report`. In a practical scenario, an attacker with local script execution rights could leverage this boundary leak to corrupt configuration files or write diagnostic output to restricted locations writable by the service process.\nRed Hat scores this vulnerability at 4.4 (Moderate) with Low Integrity impact (I:L), whereas CVEOrg scores it at 3.3 with no Integrity impact (I:N). Red Hat includes Low Integrity because the ability to overwrite existing files on disk alters file state, even if it cannot bypass underlying operating system permissions or escalate privileges to root. The issue remains bounded strictly to Low Confidentiality and Low Integrity (C:L, I:L, A:N).\nSystems and applications that do not actively enable Node.js's experimental Permission Model flag (`--experimental-permission`), or those running untrusted workloads inside standard operating system isolation primitives (such as Linux containers, cgroups, or dedicated system accounts), are not exposed to additional risk from this flaw.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[26.5.0,26.5.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[24.18.0,24.18.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.23.1,22.23.1]"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "node", "source": "cna", "vendor": "nodejs"}, "product": "nodejs", "vendor": "nodejs"}], "created": "2026-07-31T19:15:18.674725+00:00", "updated": "2026-08-05T13:45:03.913681+00:00", "vendors": ["nodejs", "nodejs$PRODUCT$nodejs"]}