CVE-2026-21636
Gravedad CVSS v3.1:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
20/01/2026
Última modificación:
20/01/2026
Descripción
*** Pendiente de traducción *** A flaw in Node.js&#39;s permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.<br />
<br />
* The issue affects users of the Node.js permission model on version v25.<br />
<br />
In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
Impacto
Puntuación base 3.x
5.80
Gravedad 3.x
MEDIA