An incomplete fix for a previous issue left promise‑based file handle methods without required permission checks, while the callback equivalents were patched correctly. The flaw allows code running under Node’s permission model with the --allow‑fs‑write restriction to still modify file permissions and ownership on already‑opened file descriptors using FileHandle.chmod() or FileHandle.chown(). The omission enables an attacker or malicious code to bypass intended write restrictions, elevating privilege to change file metadata such as permissions or owner. The weakness maps to authority bypass, improper access control, and missing authorization.

The vulnerability affects Node.js processes in the 20.x, 22.x, 24.x, and 25.x series when operating under the Permission Model that restricts file write access with --allow‑fs‑write. All installations of the nodejs:node product in those versions are impacted if they rely on the promises API for file‐permission manipulation.

The CVSS score of 3.3 indicates low overall severity, and the EPSS score below 1% suggests a relatively low likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers likely need code that can execute with restricted filesystem write permission but still has access to Node’s promise API; thus exploitation requires local code execution and awareness of the promise-based API. With the patch still pending for some distributions, the vulnerability persists until the fix is applied, but current evidence does not point to widespread public exploits.