An incomplete fix for a prior Node.js flaw left promise‑based FileHandle.chmod() and FileHandle.chown() without required permission checks while their callback equivalents were patched. As a result, code that is intended to be restricted under the Permission Model—i.e., running with --permission and a limited --allow‑fs‑write flag—can still alter permissions and ownership on already‑opened file descriptors. The weakness allows a malicious or compromised application to subvert intended security controls, potentially exposing sensitive files to unauthorized modification. The issue is rooted in misapplied access‑control logic (CWE‑279, CWE‑862).

Node.js releases 20.x, 22.x, 24.x, and 25.x run under the Permission Model with a restricted --allow‑fs‑write setting are affected. The vulnerability is specific to the promise‑based FileHandle API and does not impact the callback‑based fs.fchmod() or fs.fchown() functions, which were patched correctly. Users of these Node.js versions who rely on the Permission Model to enforce filesystem write limits are potentially exposed.

The CVSS score of 3.8 classifies the vulnerability as moderate, and the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, suggesting it has not yet been widely exploited. The likely attack vector is local code running inside a Node.js process configured with the Permission Model; an attacker can craft or alter code that invokes the promise methods to modify file permissions or ownership despite the --allow‑fs‑write restriction. Detection would require monitoring for abnormal permission changes from confined Node.js workloads.