A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read…
Affects Microsoft Security Response Center MicrosoftSource GCVE Database
Not known to be exploited · CVSS 3.3 Low.
Data as of 10/25/2026, 12:14:18 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Security Response Center Microsoft | Affected
| Fixed in– |
Description
A security flaw exists in the Node.js permission model related to filesystem enforcement, specifically affecting the fs.realpathSync() function, which does not require the necessary read permissions. This vulnerability is identified as CVE-2026-106073 and affects Microsoft product version 3.0. No CVSS score or detailed impact information is provided, and no known exploits are reported in the wild.
Impact
The vulnerability could allow an attacker to bypass read permission checks when using fs.realpathSync(), potentially leading to unauthorized access to filesystem information. However, no known exploits are reported, and the exact impact scope is not detailed in the provided data.
Summary
CVE-2026-106073 describes a flaw in the Node.js permission model where the fs.realpathSync() function bypasses required read permissions during filesystem operations. This could potentially allow unauthorized access to filesystem paths. The vulnerability is tracked under CWE-284 (Improper Access Control) and affects Microsoft product version 3.0. No further technical details or exploit information are available.
Weaknesses
- CWE-284Improper Access Control (opens in a new tab)
Pillar weaknessCWE Top 25 (2025): #19OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.