Node.js File Handle Permission Bypass Vulnerability in Promises API

A vulnerability exists in the Node.js promises API, specifically in the `FileHandle.chmod()` and `FileHandle.chown()` methods, which lack the necessary permission checks. This issue arises from an incomplete fix for CVE-2024-36137, allowing code to modify file permissions and ownership on open file descriptors. The vulnerability affects Node.js versions 20.x, 22.x, 24.x, and 25.x, when the Permission Model is used with `--allow-fs-write` restricted.

Impact

Exploitation of this vulnerability allows for unauthorized modification of file permissions and ownership, bypassing intended write restrictions.

Remediation

Users can upgrade to Node.js versions 20.20.2, 22.22.2, 24.14.1, or 25.8.2 to address this vulnerability.