CVE-2024-36137
published 2024-09-07CVE-2024-36137: A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission…
PriorityP411low3.3CVSS 3.0
AVLACLPRLUINSUCNILAN
EPSS
0.40%
32.1th percentile
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.
Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | < nodejs 20.15.1+dfsg-1 (forky) | nodejs 20.15.1+dfsg-1 (forky) |
| debian | nodejs | < nodejs 22.22.2+dfsg+~cs22.19.15-1 (forky) | nodejs 22.22.2+dfsg+~cs22.19.15-1 (forky) |
| nodejs | node | 20.20.1 – 20.20.1 | — |
| nodejs | node | 22.22.1 – 22.22.1 | — |
| nodejs | node | 24.14.0 – 24.14.0 | — |
| nodejs | node | 25.8.1 – 25.8.1 | — |
| nodejs | nodejs | >= 0 < 20.15.1-r0 | 20.15.1-r0 |
| nodejs | nodejs | >= 0 < 20.15.1-r0 | 20.15.1-r0 |
| nodejs | nodejs | >= 0 < 20.15.1-r0 | 20.15.1-r0 |
| nodejs | nodejs | >= 0 < 22.22.2-r0 | 22.22.2-r0 |
| nodejs | nodejs | >= 0 < 20.15.1-r0 | 20.15.1-r0 |
| nodejs | nodejs | >= 0 < 22.22.2-r0 | 22.22.2-r0 |
| nodejs | nodejs | >= 0 < 20.15.1-r0 | 20.15.1-r0 |
| nodejs | nodejs | >= 0 < 24.14.1-r0 | 24.14.1-r0 |
| nodejs | nodejs | >= 0 < 20.15.1+dfsg-1 | 20.15.1+dfsg-1 |
| nodejs | nodejs | >= 0 < 20.19.2+dfsg-1+deb13u2 | 20.19.2+dfsg-1+deb13u2 |
| nodejs | nodejs | >= 0 < 20.15.1+dfsg-1 | 20.15.1+dfsg-1 |
| nodejs | nodejs | >= 0 < 22.22.2+dfsg+~cs22.19.15-1 | 22.22.2+dfsg+~cs22.19.15-1 |
CVSS provenance
nvdv3.03.3LOWCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
osv3.3LOW
vendor_debian3.3LOW
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-22vj-v4r3-878v: An incomplete fix for CVE-2024-36137 leaves `FileHandle
ghsa_unreviewed·2026-03-30·CVSS 3.3
CVE-2026-21716 [LOW] CWE-862 GHSA-22vj-v4r3-878v: An incomplete fix for CVE-2024-36137 leaves `FileHandle
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.
As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
OSV
CVE-2026-21716: An incomplete fix for CVE-2024-36137 leaves `FileHandle
osv·2026-03-30·CVSS 3.3
CVE-2026-21716 [LOW] CVE-2026-21716: An incomplete fix for CVE-2024-36137 leaves `FileHandle
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
OSV
CVE-2026-21716: An incomplete fix for CVE-2024-36137 leaves `FileHandle
osv·2026-03-30·CVSS 3.3
CVE-2026-21716 [LOW] CVE-2026-21716: An incomplete fix for CVE-2024-36137 leaves `FileHandle
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.
As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
GHSA
GHSA-q793-mj5v-wh68: A vulnerability has been identified in Node
ghsa_unreviewed·2024-09-07
CVE-2024-36137 [LOW] GHSA-q793-mj5v-wh68: A vulnerability has been identified in Node
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.
Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
OSV
CVE-2024-36137: A vulnerability has been identified in Node
osv·2024-09-07·CVSS 3.3
CVE-2024-36137 [LOW] CVE-2024-36137: A vulnerability has been identified in Node
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
OSV
CVE-2024-36137: A vulnerability has been identified in Node
osv·2024-09-07·CVSS 3.3
CVE-2024-36137 [LOW] CVE-2024-36137: A vulnerability has been identified in Node
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.
Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
Red Hat
nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix.
vendor_redhat·2026-03-30·CVSS 3.3
CVE-2026-21716 [LOW] CWE-279 nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix.
nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix.
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.
As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
A flaw was found in Node.
Debian
CVE-2026-21716: nodejs - An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle...
vendor_debian·2026·CVSS 3.3
CVE-2026-21716 [LOW] CVE-2026-21716: nodejs - An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle...
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 22.22.2+dfsg+~cs22.19.15-1)
sid: resolved (fixed in 22.22.2+dfsg+~cs22.19.15-1)
trixie: r
Red Hat
nodejs: fs.fchown/fchmod bypasses permission model
vendor_redhat·2024-07-08·CVSS 3.3
CVE-2024-36137 [LOW] CWE-732 nodejs: fs.fchown/fchmod bypasses permission model
nodejs: fs.fchown/fchmod bypasses permission model
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.
Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
A flaw was found in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. The Node.js Permission Model does not operate on file descriptors. However, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
Statement: This vulnerability is specific to the Permission Model, which is current
Debian
CVE-2024-36137: nodejs - A vulnerability has been identified in Node.js, affecting users of the experimen...
vendor_debian·2024·CVSS 3.3
CVE-2024-36137 [LOW] CVE-2024-36137: nodejs - A vulnerability has been identified in Node.js, affecting users of the experimen...
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 20.15.1+dfsg-1)
sid: resolved (fixed in 20.15.1+dfsg-1)
trixie: resolved (fixed in 20.15.1+dfsg-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-21716 nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix.
bugzilla·2026-03-30·CVSS 3.3
CVE-2026-21716 [LOW] CVE-2026-21716 nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix.
CVE-2026-21716 nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix.
An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.
As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.
Discuss
HackerOne
fs.fchown/fchmod bypasses permission model
hackerone·2024-10-16·CVSS 3.3
CVE-2024-36137 [LOW] fs.fchown/fchmod bypasses permission model
fs.fchown/fchmod bypasses permission model
Hello IBB team, i would like to submit a report about Node.js vulnerability that i have reported to the Node.js team, which was assigned to CVE-2024-36137 and disclosed today. Please check #2472071.
Modifier: I have proposed a fix(-25% shouldn't be apllied) and the feature is experimental (-50%), so I believe the final ratio is 50%.
## Details:
A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.
Node.js Permission Model do not operate on file descriptors, however, operations such as `fs.fchown` or `fs.fchmod` can use a "read-only" file descriptor to change the owner and permissions of a file.
This vulnerability affects all users using the experimental per
2024-09-07
Published