[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-21716":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T17:19:26.604Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":229,"aliases":230,"duplicate_of":9,"upstream":231,"downstream":232,"duplicates":279,"related":280,"reserved_at":9,"published_at":295,"modified_at":296,"state":297,"summary":298,"references_raw":306,"kevs":312,"epss":313,"epss_history":316,"metrics":546,"affected":554},"CVE-2026-21716","An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched.\r\n\r\nAs a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions.\r\n\r\nThis vulnerability affects **20.x, 22.x, 24.x, and 25.x** processes using the Permission Model where `--allow-fs-write` is intentionally restricted.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-862","Missing Authorization","The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","weakness","Incomplete","Class","High",[20],{"id":21,"name":22,"techniques":23},"CAPEC-665","Exploitation of Thunderbolt Protection Flaws",[24,61,101],{"id":25,"name":26,"tactics":27,"countermeasures":34},"T1211","Exploitation for Stealth",[28,31],{"id":29,"name":30},"TA0030","Defense Evasion",{"id":32,"name":33},"TA0005","Stealth",[35,40,44,48,53,57],{"id":36,"name":37,"tactic":38},"D3-MBT","Memory Boundary Tracking",{"name":39},"Detect",{"id":41,"name":42,"tactic":43},"D3-PCSV","Process Code Segment Verification",{"name":39},{"id":45,"name":46,"tactic":47},"D3-SSC","Shadow Stack Comparisons",{"name":39},{"id":49,"name":50,"tactic":51},"D3-PSEP","Process Segment Execution Prevention",{"name":52},"Harden",{"id":54,"name":55,"tactic":56},"D3-SAOR","Segment Address Offset Randomization",{"name":52},{"id":58,"name":59,"tactic":60},"D3-SFCV","Stack Frame Canary Validation",{"name":52},{"id":62,"name":63,"tactics":64,"countermeasures":70},"T1542.002","Component Firmware",[65,66,67],{"id":29,"name":30},{"id":32,"name":33},{"id":68,"name":69},"TA0110","Persistence",[71,76,80,84,88,92,96],{"id":72,"name":73,"tactic":74},"D3-SWI","Software Inventory",{"name":75},"Model",{"id":77,"name":78,"tactic":79},"D3-AVE","Asset Vulnerability Enumeration",{"name":75},{"id":81,"name":82,"tactic":83},"D3-FEMC","Firmware Embedded Monitoring Code",{"name":39},{"id":85,"name":86,"tactic":87},"D3-FV","Firmware Verification",{"name":39},{"id":89,"name":90,"tactic":91},"D3-FBA","Firmware Behavior Analysis",{"name":39},{"id":93,"name":94,"tactic":95},"D3-SU","Software Update",{"name":52},{"id":97,"name":98,"tactic":99},"D3-RS","Restore Software",{"name":100},"Restore",{"id":102,"name":103,"tactics":104,"countermeasures":113},"T1556","Modify Authentication Process",[105,106,109,110],{"id":29,"name":30},{"id":107,"name":108},"TA0112","Defense Impairment",{"id":68,"name":69},{"id":111,"name":112},"TA0031","Credential Access",[114,118,122,126,130,134,138,142,146,150,155,159,163,167,171,176,180,184,188,193,197,201,205,209,213,217,221,225],{"id":115,"name":116,"tactic":117},"D3-CI","Configuration Inventory",{"name":75},{"id":119,"name":120,"tactic":121},"D3-NTPM","Network Traffic Policy Mapping",{"name":75},{"id":123,"name":124,"tactic":125},"D3-AM","Access Modeling",{"name":75},{"id":127,"name":128,"tactic":129},"D3-FA","File Analysis",{"name":39},{"id":131,"name":132,"tactic":133},"D3-FIM","File Integrity Monitoring",{"name":39},{"id":135,"name":136,"tactic":137},"D3-PLA","Process Lineage Analysis",{"name":39},{"id":139,"name":140,"tactic":141},"D3-PSMD","Process Self-Modification Detection",{"name":39},{"id":143,"name":144,"tactic":145},"D3-PSA","Process Spawn Analysis",{"name":39},{"id":147,"name":148,"tactic":149},"D3-SFA","System File Analysis",{"name":39},{"id":151,"name":152,"tactic":153},"D3-FEV","File Eviction",{"name":154},"Evict",{"id":156,"name":157,"tactic":158},"D3-PT","Process Termination",{"name":154},{"id":160,"name":161,"tactic":162},"D3-PS","Process Suspension",{"name":154},{"id":164,"name":165,"tactic":166},"D3-HR","Host Reboot",{"name":154},{"id":168,"name":169,"tactic":170},"D3-HS","Host Shutdown",{"name":154},{"id":172,"name":173,"tactic":174},"D3-DF","Decoy File",{"name":175},"Deceive",{"id":177,"name":178,"tactic":179},"D3-FE","File Encryption",{"name":52},{"id":181,"name":182,"tactic":183},"D3-RF","Restore File",{"name":100},{"id":185,"name":186,"tactic":187},"D3-RC","Restore Configuration",{"name":100},{"id":189,"name":190,"tactic":191},"D3-CF","Content Filtering",{"name":192},"Isolate",{"id":194,"name":195,"tactic":196},"D3-LFP","Local File Permissions",{"name":192},{"id":198,"name":199,"tactic":200},"D3-RFAM","Remote File Access Mediation",{"name":192},{"id":202,"name":203,"tactic":204},"D3-CQ","Content Quarantine",{"name":192},{"id":206,"name":207,"tactic":208},"D3-CM","Content Modification",{"name":192},{"id":210,"name":211,"tactic":212},"D3-KBPI","Kernel-based Process Isolation",{"name":192},{"id":214,"name":215,"tactic":216},"D3-SCF","System Call Filtering",{"name":192},{"id":218,"name":219,"tactic":220},"D3-HBPI","Hardware-based Process Isolation",{"name":192},{"id":222,"name":223,"tactic":224},"D3-ABPI","Application-based Process Isolation",{"name":192},{"id":226,"name":227,"tactic":228},"D3-WSAM","Web Session Access Mediation",{"name":192},[],[],[],[233,235,237,239,241,243,245,247,249,251,253,255,257,259,261,263,265,267,269,271,273,275,277],{"_key":234},"DSA-6183-1",{"_key":236},"OPENSUSE-SU-2026:10504-1",{"_key":238},"SUSE-SU-2026:1299-1",{"_key":240},"MGASA-2026-0071",{"_key":242},"SUSE-SU-2026:1363-1",{"_key":244},"SUSE-SU-2026:1371-1",{"_key":246},"SUSE-SU-2026:1478-1",{"_key":248},"SUSE-SU-2026:1509-1",{"_key":250},"SUSE-SU-2026:21181-1",{"_key":252},"OPENSUSE-SU-2026:20519-1",{"_key":254},"UBUNTU-CVE-2026-21716",{"_key":256},"ALPINE-CVE-2026-21716",{"_key":258},"DEBIAN-CVE-2026-21716",{"_key":260},"OPENSUSE-SU-2026:11110-1",{"_key":262},"SUSE-SU-2026:22368-1",{"_key":264},"OPENSUSE-SU-2026:21058-1",{"_key":266},"RHSA-2026:6402",{"_key":268},"RHSA-2026:6431",{"_key":270},"RHSA-2026:7350",{"_key":272},"RHSA-2026:7386",{"_key":274},"RHSA-2026:7387",{"_key":276},"RHSA-2026:7670",{"_key":278},"RHSA-2026:7675",[],[281,282,283,284,285,286,287,288,289,290,291,292,293],{"_key":236},{"_key":238},{"_key":240},{"_key":242},{"_key":244},{"_key":246},{"_key":248},{"_key":250},{"_key":252},{"_key":260},{"_key":262},{"_key":264},{"_key":294},"CGA-C43C-PR4R-G3XV","2026-03-30T19:07:28.538Z","2026-03-31T14:27:23.323Z","Awaiting Analysis",{"cisa_kev":299,"cisa_ransomware":299,"cisa_vendor":9,"epss_severity":300,"epss_score":301,"severity":300,"severity_score":302,"severity_version":303,"severity_source":304,"severity_vector":305,"severity_status":297},false,"low",0.00159,3.3,"v3.0","cve.org","CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",[307],{"url":308,"sources":309,"tags":311},"https://nodejs.org/en/blog/vulnerability/march-2026-security-releases",[304,310],"nvd",[],[],{"date":314,"score":301,"percentile":315},"2026-07-05",0.05435,[317,321,324,327,329,332,335,338,340,342,344,347,349,351,353,355,357,359,362,364,366,368,371,373,375,378,380,382,384,386,388,390,394,397,399,401,404,406,408,410,412,414,417,420,423,425,428,431,433,436,439,441,443,446,448,450,452,454,457,460,463,466,469,472,474,476,479,481,485,488,491,494,496,498,500,503,506,509,512,515,518,521,524,527,530,532,535,537,540,543],{"date":318,"score":319,"percentile":320},"2026-03-31",0.00004,0.00197,{"date":322,"score":319,"percentile":323},"2026-04-01",0.00176,{"date":325,"score":319,"percentile":326},"2026-04-02",0.00177,{"date":328,"score":319,"percentile":326},"2026-04-03",{"date":330,"score":319,"percentile":331},"2026-04-04",0.00169,{"date":333,"score":319,"percentile":334},"2026-04-05",0.00198,{"date":336,"score":319,"percentile":337},"2026-04-06",0.00196,{"date":339,"score":319,"percentile":337},"2026-04-07",{"date":341,"score":319,"percentile":337},"2026-04-08",{"date":343,"score":319,"percentile":337},"2026-04-09",{"date":345,"score":319,"percentile":346},"2026-04-10",0.00199,{"date":348,"score":319,"percentile":334},"2026-04-11",{"date":350,"score":319,"percentile":334},"2026-04-12",{"date":352,"score":319,"percentile":334},"2026-04-13",{"date":354,"score":319,"percentile":320},"2026-04-14",{"date":356,"score":319,"percentile":320},"2026-04-15",{"date":358,"score":319,"percentile":346},"2026-04-16",{"date":360,"score":319,"percentile":361},"2026-04-17",0.002,{"date":363,"score":319,"percentile":346},"2026-04-18",{"date":365,"score":319,"percentile":334},"2026-04-19",{"date":367,"score":319,"percentile":337},"2026-04-20",{"date":369,"score":319,"percentile":370},"2026-04-21",0.00201,{"date":372,"score":319,"percentile":361},"2026-04-22",{"date":374,"score":319,"percentile":370},"2026-04-23",{"date":376,"score":319,"percentile":377},"2026-04-24",0.00202,{"date":379,"score":319,"percentile":377},"2026-04-25",{"date":381,"score":319,"percentile":377},"2026-04-26",{"date":383,"score":319,"percentile":377},"2026-04-27",{"date":385,"score":319,"percentile":346},"2026-04-28",{"date":387,"score":319,"percentile":346},"2026-04-29",{"date":389,"score":319,"percentile":370},"2026-04-30",{"date":391,"score":392,"percentile":393},"2026-05-01",0.00005,0.00247,{"date":395,"score":392,"percentile":396},"2026-05-02",0.00248,{"date":398,"score":392,"percentile":393},"2026-05-03",{"date":400,"score":392,"percentile":393},"2026-05-04",{"date":402,"score":392,"percentile":403},"2026-05-05",0.00246,{"date":405,"score":392,"percentile":403},"2026-05-06",{"date":407,"score":392,"percentile":393},"2026-05-07",{"date":409,"score":392,"percentile":396},"2026-05-08",{"date":411,"score":392,"percentile":396},"2026-05-09",{"date":413,"score":392,"percentile":396},"2026-05-10",{"date":415,"score":392,"percentile":416},"2026-05-11",0.00245,{"date":418,"score":392,"percentile":419},"2026-05-12",0.00242,{"date":421,"score":392,"percentile":422},"2026-05-13",0.00241,{"date":424,"score":392,"percentile":422},"2026-05-14",{"date":426,"score":392,"percentile":427},"2026-05-15",0.00239,{"date":429,"score":392,"percentile":430},"2026-05-16",0.0024,{"date":432,"score":392,"percentile":430},"2026-05-17",{"date":434,"score":392,"percentile":435},"2026-05-18",0.00237,{"date":437,"score":392,"percentile":438},"2026-05-19",0.00238,{"date":440,"score":392,"percentile":435},"2026-05-20",{"date":442,"score":392,"percentile":438},"2026-05-21",{"date":444,"score":392,"percentile":445},"2026-05-22",0.00249,{"date":447,"score":392,"percentile":396},"2026-05-23",{"date":449,"score":392,"percentile":445},"2026-05-24",{"date":451,"score":392,"percentile":396},"2026-05-25",{"date":453,"score":392,"percentile":445},"2026-05-26",{"date":455,"score":392,"percentile":456},"2026-05-27",0.00253,{"date":458,"score":392,"percentile":459},"2026-05-28",0.00254,{"date":461,"score":392,"percentile":462},"2026-05-29",0.00258,{"date":464,"score":392,"percentile":465},"2026-05-30",0.00263,{"date":467,"score":392,"percentile":468},"2026-05-31",0.00262,{"date":470,"score":392,"percentile":471},"2026-06-01",0.00261,{"date":473,"score":392,"percentile":465},"2026-06-02",{"date":475,"score":392,"percentile":465},"2026-06-03",{"date":477,"score":392,"percentile":478},"2026-06-04",0.00264,{"date":480,"score":392,"percentile":465},"2026-06-05",{"date":482,"score":483,"percentile":484},"2026-06-06",0.00006,0.0036,{"date":486,"score":483,"percentile":487},"2026-06-07",0.00357,{"date":489,"score":483,"percentile":490},"2026-06-08",0.00355,{"date":492,"score":483,"percentile":493},"2026-06-09",0.00356,{"date":495,"score":483,"percentile":493},"2026-06-10",{"date":497,"score":483,"percentile":493},"2026-06-11",{"date":499,"score":483,"percentile":490},"2026-06-12",{"date":501,"score":483,"percentile":502},"2026-06-13",0.00353,{"date":504,"score":483,"percentile":505},"2026-06-14",0.00359,{"date":507,"score":301,"percentile":508},"2026-06-15",0.05408,{"date":510,"score":301,"percentile":511},"2026-06-16",0.05416,{"date":513,"score":301,"percentile":514},"2026-06-17",0.05419,{"date":516,"score":301,"percentile":517},"2026-06-18",0.05415,{"date":519,"score":301,"percentile":520},"2026-06-19",0.05407,{"date":522,"score":301,"percentile":523},"2026-06-20",0.05396,{"date":525,"score":301,"percentile":526},"2026-06-21",0.05388,{"date":528,"score":301,"percentile":529},"2026-06-22",0.05378,{"date":531,"score":301,"percentile":529},"2026-06-23",{"date":533,"score":301,"percentile":534},"2026-06-24",0.05384,{"date":536,"score":301,"percentile":520},"2026-06-25",{"date":538,"score":301,"percentile":539},"2026-06-26",0.05431,{"date":541,"score":301,"percentile":542},"2026-06-27",0.05443,{"date":544,"score":301,"percentile":545},"2026-06-28",0.05461,[547,552],{"source":304,"cvss_v2_0":9,"cvss_v3_0":548,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":302,"baseSeverity":549,"vectorString":305,"impactScore":550,"exploitabilityScore":551},"LOW",2.3,4.6,{"source":310,"cvss_v2_0":9,"cvss_v3_0":553,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":302,"baseSeverity":549,"vectorString":305,"impactScore":550,"exploitabilityScore":551},[555],{"ecosystem":9,"name":556,"vendor":557,"product":556,"cpe_part":558,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":559},"node","nodejs","a",[560,565,568,571],{"version":561,"is_range":562,"range_type":304,"version_start":563,"version_start_type":564,"version_end":563,"version_end_type":564,"fixed_in":9},">= 20.20.1, \u003C= 20.20.1",true,"20.20.1","including",{"version":566,"is_range":562,"range_type":304,"version_start":567,"version_start_type":564,"version_end":567,"version_end_type":564,"fixed_in":9},">= 22.22.1, \u003C= 22.22.1","22.22.1",{"version":569,"is_range":562,"range_type":304,"version_start":570,"version_start_type":564,"version_end":570,"version_end_type":564,"fixed_in":9},">= 24.14.0, \u003C= 24.14.0","24.14.0",{"version":572,"is_range":562,"range_type":304,"version_start":573,"version_start_type":564,"version_end":573,"version_end_type":564,"fixed_in":9},">= 25.8.1, \u003C= 25.8.1","25.8.1"]