nodejs: Security fix for CVE-2026-48617

Pick patch from [1] also mentioned at Debian tracker in [2] [1] https://github.com/nodejs/node/commit/2f62693801a12bc8a485b3b7da3239ac522f607d [2] https://security-tracker.debian.org/tracker/CVE-2026-48617 Signed-off-by: Rohini Sangam <rsangam@mvista.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-11-14 16:07:25 +00:00 · 2026-10-26 10:10:48 +05:30
1 parent 5d26da35b0
commit 19db4514a1
@@ -0,0 +1,118 @@
+From 2f62693801a12bc8a485b3b7da3239ac522f607d Mon Sep 17 00:00:00 2001
+From: RafaelGSS <rafael.nunu@hotmail.com>
+Date: Mon, 11 May 2026 18:25:16 -0300
+Subject: [PATCH] permission: handle process.chdir on writereport
+
+Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
+PR-URL: https://github.com/nodejs-private/node-private/pull/870
+Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
+Refs: https://hackerone.com/reports/3625987
+
+CVE: CVE-2026-48617
+Upstream-Status: Backport [https://github.com/nodejs/node/commit/2f62693801a12bc8a485b3b7da3239ac522f607d]
+
+Signed-off-by: Rohini Sangam <rsangam@mvista.com>
+---
+ lib/internal/process/report.js                | 13 ++++++
+ .../test-permission-fs-write-report.js        | 42 +++++++++++++++++++
+ 2 files changed, 55 insertions(+)
+
+diff --git a/lib/internal/process/report.js b/lib/internal/process/report.js
+index 1639142d..7adaeacc 100644
+--- a/lib/internal/process/report.js
+++ b/lib/internal/process/report.js
+@@ -1,8 +1,10 @@
+ 'use strict';
+ const {
+  ERR_ACCESS_DENIED,
+   ERR_SYNTHETIC,
+ } = require('internal/errors').codes;
+ const { getValidatedPath } = require('internal/fs/utils');
+const permission = require('internal/process/permission');
+ const {
+   validateBoolean,
+   validateObject,
+@@ -23,6 +25,17 @@ const report = {
+       file = getValidatedPath(file);
+     }
+ 
+    if (permission.isEnabled()) {
+      const resource = file ?? process.cwd();
+      if (!permission.has('fs.write', resource)) {
+        throw new ERR_ACCESS_DENIED(
+          'Access to this API has been restricted',
+          'FileSystemWrite',
+          resource,
+        );
+      }
+    }
+
+     if (err === undefined) {
+       err = new ERR_SYNTHETIC();
+     } else {
+diff --git a/test/parallel/test-permission-fs-write-report.js b/test/parallel/test-permission-fs-write-report.js
+index c8f6673d..f51b86b3 100644
+--- a/test/parallel/test-permission-fs-write-report.js
+++ b/test/parallel/test-permission-fs-write-report.js
+@@ -1,12 +1,28 @@
+ // Flags: --experimental-permission --allow-fs-read=*
+ 'use strict';
+ 
+const { spawnSyncAndExitWithoutError } = require('../common/child_process');
+
+ const common = require('../common');
+ common.skipIfWorker();
+ if (!common.hasCrypto)
+   common.skip('no crypto');
+ 
+// We need to define the flags dynamically to account for the `NODE_TEST_DIR` env var.
+if (!process.permission) {
+  spawnSyncAndExitWithoutError(process.execPath, [
+    '--permission',
+    '--allow-fs-read=*', `--allow-fs-write=${process.env.NODE_TEST_DIR || './test'}/.tmp.*`, '--allow-child-process',
+    __filename,
+  ]);
+  return;
+}
+
+ const assert = require('assert');
+const path = require('path');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+ 
+ {
+   assert.throws(() => {
+@@ -27,3 +43,29 @@ const assert = require('assert');
+     resource: process.cwd(),
+   }));
+ }
+
+{
+  const reportPath = path.join(tmpdir.path, 'report.json');
+  spawnSyncAndExitWithoutError(
+    process.execPath,
+    [
+      '--permission',
+      '--allow-fs-read=*',
+      `--allow-fs-write=${tmpdir.path}/*`,
+      '-e',
+      `process.report.writeReport(${JSON.stringify(reportPath)})`,
+    ]
+  );
+}
+
+spawnSyncAndExitWithoutError(
+  process.execPath,
+ [
+    '--permission',
+    '--allow-fs-read=*',
+    `--allow-fs-write=${tmpdir.path}`,
+    '-e',
+    'process.report.writeReport()',
+  ],
+  { cwd: tmpdir.path }
+);
+-- 
+2.44.4
+
@@ -26,6 +26,7 @@ SRC_URI = "http://nodejs.org/dist/v${PV}/node-v${PV}.tar.xz \
           file://libatomic.patch \
           file://0001-Revert-stop-using-deprecated-ares_query.patch \
           file://run-ptest \
+           file://CVE-2026-48617.patch \
           "
 SRC_URI:append:class-target = " \
           file://0001-Using-native-binaries.patch \