This vulnerability arises from an incomplete patch for CVE-2024-36137 in Node.js. While the callback-based file system methods fs.fchmod() and fs.fchown() were properly secured with permission checks, the promise-based FileHandle.chmod() and FileHandle.chown() methods remain vulnerable. When Node.js processes run with the Permission Model restricting --allow-fs-write, these promise-based methods can still modify file permissions and ownership on already-open file descriptors, effectively bypassing the intended write restrictions. Affected versions include 20.20.1, 22.22.1, 24.14.0, and 25.8.1.

The vulnerability allows code running with restricted file system write permissions to bypass these restrictions and modify file permissions and ownership on open file descriptors using promise-based APIs. This could lead to unauthorized changes to file metadata, potentially impacting system integrity or security policies. The CVSS score of 3.3 reflects a low severity with limited impact, requiring local privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided at this time. Users should monitor Node.js vendor advisories for updates addressing this incomplete fix. Until a patch is available, avoid relying solely on the Permission Model's --allow-fs-write restrictions when using promise-based FileHandle methods.