[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-48935":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T11:19:25.255Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":131,"aliases":132,"duplicate_of":9,"upstream":133,"downstream":134,"duplicates":181,"related":182,"reserved_at":9,"published_at":192,"modified_at":193,"state":194,"summary":195,"references_raw":203,"kevs":208,"epss":209,"epss_history":212,"metrics":242,"affected":248},"CVE-2026-48935","A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-276","Incorrect Default Permissions","During installation, installed file permissions are set to allow anyone to modify those files.","weakness","Draft","Base","Medium",[20,68,127],{"id":21,"name":22,"techniques":23},"CAPEC-1","Accessing Functionality Not Properly Constrained by ACLs",[24],{"id":25,"name":26,"tactics":27,"countermeasures":43},"T1574.010","Services File Permissions Weakness",[28,31,34,37,40],{"id":29,"name":30},"TA0110","Persistence",{"id":32,"name":33},"TA0111","Privilege Escalation",{"id":35,"name":36},"TA0030","Defense Evasion",{"id":38,"name":39},"TA0005","Stealth",{"id":41,"name":42},"TA0104","Execution",[44,49,53,58,63],{"id":45,"name":46,"tactic":47},"D3-SWI","Software Inventory",{"name":48},"Model",{"id":50,"name":51,"tactic":52},"D3-AVE","Asset Vulnerability Enumeration",{"name":48},{"id":54,"name":55,"tactic":56},"D3-SBV","Service Binary Verification",{"name":57},"Detect",{"id":59,"name":60,"tactic":61},"D3-SU","Software Update",{"name":62},"Harden",{"id":64,"name":65,"tactic":66},"D3-RS","Restore Software",{"name":67},"Restore",{"id":69,"name":70,"techniques":71},"CAPEC-127","Directory Indexing",[72],{"id":73,"name":74,"tactics":75,"countermeasures":79},"T1083","File and Directory Discovery",[76],{"id":77,"name":78},"TA0102","Discovery",[80,84,88,93,98,102,106,111,115,119,123],{"id":81,"name":82,"tactic":83},"D3-FA","File Analysis",{"name":57},{"id":85,"name":86,"tactic":87},"D3-FIM","File Integrity Monitoring",{"name":57},{"id":89,"name":90,"tactic":91},"D3-FEV","File Eviction",{"name":92},"Evict",{"id":94,"name":95,"tactic":96},"D3-DF","Decoy File",{"name":97},"Deceive",{"id":99,"name":100,"tactic":101},"D3-FE","File Encryption",{"name":62},{"id":103,"name":104,"tactic":105},"D3-RF","Restore File",{"name":67},{"id":107,"name":108,"tactic":109},"D3-LFP","Local File Permissions",{"name":110},"Isolate",{"id":112,"name":113,"tactic":114},"D3-CF","Content Filtering",{"name":110},{"id":116,"name":117,"tactic":118},"D3-RFAM","Remote File Access Mediation",{"name":110},{"id":120,"name":121,"tactic":122},"D3-CQ","Content Quarantine",{"name":110},{"id":124,"name":125,"tactic":126},"D3-CM","Content Modification",{"name":110},{"id":128,"name":129,"techniques":130},"CAPEC-81","Web Server Logs Tampering",[],[],[],[],[135,137,139,141,143,145,147,149,151,153,155,157,159,161,163,165,167,169,171,173,175,177,179],{"_key":136},"OPENSUSE-SU-2026:11110-1",{"_key":138},"SUSE-SU-2026:2633-1",{"_key":140},"OPENSUSE-SU-2026:11121-1",{"_key":142},"DEBIAN-CVE-2026-48935",{"_key":144},"SUSE-SU-2026:2647-1",{"_key":146},"ALPINE-CVE-2026-48935",{"_key":148},"UBUNTU-CVE-2026-48935",{"_key":150},"SUSE-SU-2026:22368-1",{"_key":152},"SUSE-SU-2026:2695-1",{"_key":154},"OPENSUSE-SU-2026:21058-1",{"_key":156},"OPENSUSE-SU-2026:21236-1",{"_key":158},"MGASA-2026-0257",{"_key":160},"SUSE-SU-2026:22565-1",{"_key":162},"RHSA-2026:33866",{"_key":164},"RHSA-2026:34478",{"_key":166},"RHSA-2026:35272",{"_key":168},"RHSA-2026:35841",{"_key":170},"RHSA-2026:35842",{"_key":172},"RHSA-2026:35891",{"_key":174},"RHSA-2026:35892",{"_key":176},"RHSA-2026:39868",{"_key":178},"RHSA-2026:7378",{"_key":180},"RHSA-2026:9455",[],[183,184,185,186,187,188,189,190,191],{"_key":136},{"_key":138},{"_key":140},{"_key":144},{"_key":150},{"_key":152},{"_key":154},{"_key":156},{"_key":160},"2026-06-26T01:14:36.641Z","2026-06-26T15:05:20.661Z","PUBLISHED",{"cisa_kev":196,"cisa_ransomware":196,"cisa_vendor":9,"epss_severity":197,"epss_score":198,"severity":197,"severity_score":199,"severity_version":200,"severity_source":201,"severity_vector":202,"severity_status":194},false,"low",0.00154,3.3,"v3.0","cve.org","CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",[204],{"url":205,"sources":206,"tags":207},"https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",[201],[],[],{"date":210,"score":198,"percentile":211},"2026-07-05",0.04956,[213,217,220,223,226,229,232,235,238,241],{"date":214,"score":215,"percentile":216},"2026-06-26",0.00149,0.04492,{"date":218,"score":215,"percentile":219},"2026-06-27",0.04495,{"date":221,"score":215,"percentile":222},"2026-06-28",0.04515,{"date":224,"score":215,"percentile":225},"2026-06-29",0.04513,{"date":227,"score":215,"percentile":228},"2026-06-30",0.04508,{"date":230,"score":198,"percentile":231},"2026-07-01",0.04964,{"date":233,"score":198,"percentile":234},"2026-07-02",0.0496,{"date":236,"score":198,"percentile":237},"2026-07-03",0.04952,{"date":239,"score":198,"percentile":240},"2026-07-04",0.04955,{"date":210,"score":198,"percentile":211},[243],{"source":201,"cvss_v2_0":9,"cvss_v3_0":244,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":199,"baseSeverity":245,"vectorString":202,"impactScore":246,"exploitabilityScore":247},"LOW",2.3,4.6,[249],{"ecosystem":9,"name":250,"vendor":251,"product":250,"cpe_part":252,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":253},"node","nodejs","a",[254,259,262],{"version":255,"is_range":256,"range_type":201,"version_start":257,"version_start_type":258,"version_end":257,"version_end_type":258,"fixed_in":9},">= 22.22.3, \u003C= 22.22.3",true,"22.22.3","including",{"version":260,"is_range":256,"range_type":201,"version_start":261,"version_start_type":258,"version_end":261,"version_end_type":258,"fixed_in":9},">= 24.16.0, \u003C= 24.16.0","24.16.0",{"version":263,"is_range":256,"range_type":201,"version_start":264,"version_start_type":258,"version_end":264,"version_end_type":258,"fixed_in":9},">= 26.3.0, \u003C= 26.3.0","26.3.0"]