CVE-2026-106073

LowCVSS 3.3/10Last modified Oct 23, 2026

Description

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`.

As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories.

This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

Metrics

CVSS 3.0 3.3/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 23, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1060744.8A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt(CVE-2026-106087.3A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the file /plus/carbuyaction.php. The manipulat CVE-2026-1060898.8ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curre CVE-2026-106096.8A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to CVE-2026-1060908.8ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curre CVE-2026-1060953.3The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives th CVE-2026-1060976.8The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in so CVE-2026-1060985.3The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifyin CVE-2026-1060995.3The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only wi CVE-2026-10619.8A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhj CVE-2026-106108.5Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user.CVE-2026-1061007.1Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions b