From 19db4514a180303c633be156a1ba0b8f125b39fe Mon Sep 17 00:00:00 2001
From: Rohini Sangam <rsangam@mvista.com>
Date: Thu, 15 Oct 2026 15:49:34 +0530
Subject: [PATCH] nodejs: Security fix for CVE-2026-48617

Pick patch from [1] also mentioned at Debian tracker in [2]

[1] https://github.com/nodejs/node/commit/2f62693801a12bc8a485b3b7da3239ac522f607d
[2] https://security-tracker.debian.org/tracker/CVE-2026-48617

Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
---
 .../nodejs/nodejs/CVE-2026-48617.patch        | 118 ++++++++++++++++++
 .../recipes-devtools/nodejs/nodejs_20.20.2.bb |   1 +
 2 files changed, 119 insertions(+)
 create mode 100644 meta-oe/recipes-devtools/nodejs/nodejs/CVE-2026-48617.patch

diff --git a/meta-oe/recipes-devtools/nodejs/nodejs/CVE-2026-48617.patch b/meta-oe/recipes-devtools/nodejs/nodejs/CVE-2026-48617.patch
new file mode 100644
index 0000000000..ec3bf7e615
--- /dev/null
+++ b/meta-oe/recipes-devtools/nodejs/nodejs/CVE-2026-48617.patch
@@ -0,0 +1,118 @@
+From 2f62693801a12bc8a485b3b7da3239ac522f607d Mon Sep 17 00:00:00 2001
+From: RafaelGSS <rafael.nunu@hotmail.com>
+Date: Mon, 11 May 2026 18:25:16 -0300
+Subject: [PATCH] permission: handle process.chdir on writereport
+
+Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
+PR-URL: https://github.com/nodejs-private/node-private/pull/870
+Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
+Refs: https://hackerone.com/reports/3625987
+
+CVE: CVE-2026-48617
+Upstream-Status: Backport [https://github.com/nodejs/node/commit/2f62693801a12bc8a485b3b7da3239ac522f607d]
+
+Signed-off-by: Rohini Sangam <rsangam@mvista.com>
+---
+ lib/internal/process/report.js                | 13 ++++++
+ .../test-permission-fs-write-report.js        | 42 +++++++++++++++++++
+ 2 files changed, 55 insertions(+)
+
+diff --git a/lib/internal/process/report.js b/lib/internal/process/report.js
+index 1639142d..7adaeacc 100644
+--- a/lib/internal/process/report.js
++++ b/lib/internal/process/report.js
+@@ -1,8 +1,10 @@
+ 'use strict';
+ const {
++  ERR_ACCESS_DENIED,
+   ERR_SYNTHETIC,
+ } = require('internal/errors').codes;
+ const { getValidatedPath } = require('internal/fs/utils');
++const permission = require('internal/process/permission');
+ const {
+   validateBoolean,
+   validateObject,
+@@ -23,6 +25,17 @@ const report = {
+       file = getValidatedPath(file);
+     }
+ 
++    if (permission.isEnabled()) {
++      const resource = file ?? process.cwd();
++      if (!permission.has('fs.write', resource)) {
++        throw new ERR_ACCESS_DENIED(
++          'Access to this API has been restricted',
++          'FileSystemWrite',
++          resource,
++        );
++      }
++    }
++
+     if (err === undefined) {
+       err = new ERR_SYNTHETIC();
+     } else {
+diff --git a/test/parallel/test-permission-fs-write-report.js b/test/parallel/test-permission-fs-write-report.js
+index c8f6673d..f51b86b3 100644
+--- a/test/parallel/test-permission-fs-write-report.js
++++ b/test/parallel/test-permission-fs-write-report.js
+@@ -1,12 +1,28 @@
+ // Flags: --experimental-permission --allow-fs-read=*
+ 'use strict';
+ 
++const { spawnSyncAndExitWithoutError } = require('../common/child_process');
++
+ const common = require('../common');
+ common.skipIfWorker();
+ if (!common.hasCrypto)
+   common.skip('no crypto');
+ 
++// We need to define the flags dynamically to account for the `NODE_TEST_DIR` env var.
++if (!process.permission) {
++  spawnSyncAndExitWithoutError(process.execPath, [
++    '--permission',
++    '--allow-fs-read=*', `--allow-fs-write=${process.env.NODE_TEST_DIR || './test'}/.tmp.*`, '--allow-child-process',
++    __filename,
++  ]);
++  return;
++}
++
+ const assert = require('assert');
++const path = require('path');
++const tmpdir = require('../common/tmpdir');
++
++tmpdir.refresh();
+ 
+ {
+   assert.throws(() => {
+@@ -27,3 +43,29 @@ const assert = require('assert');
+     resource: process.cwd(),
+   }));
+ }
++
++{
++  const reportPath = path.join(tmpdir.path, 'report.json');
++  spawnSyncAndExitWithoutError(
++    process.execPath,
++    [
++      '--permission',
++      '--allow-fs-read=*',
++      `--allow-fs-write=${tmpdir.path}/*`,
++      '-e',
++      `process.report.writeReport(${JSON.stringify(reportPath)})`,
++    ]
++  );
++}
++
++spawnSyncAndExitWithoutError(
++  process.execPath,
++ [
++    '--permission',
++    '--allow-fs-read=*',
++    `--allow-fs-write=${tmpdir.path}`,
++    '-e',
++    'process.report.writeReport()',
++  ],
++  { cwd: tmpdir.path }
++);
+-- 
+2.44.4
+
diff --git a/meta-oe/recipes-devtools/nodejs/nodejs_20.20.2.bb b/meta-oe/recipes-devtools/nodejs/nodejs_20.20.2.bb
index aa6189da60..4badec2135 100644
--- a/meta-oe/recipes-devtools/nodejs/nodejs_20.20.2.bb
+++ b/meta-oe/recipes-devtools/nodejs/nodejs_20.20.2.bb
@@ -26,6 +26,7 @@ SRC_URI = "http://nodejs.org/dist/v${PV}/node-v${PV}.tar.xz \
            file://libatomic.patch \
            file://0001-Revert-stop-using-deprecated-ares_query.patch \
            file://run-ptest \
+           file://CVE-2026-48617.patch \
            "
 SRC_URI:append:class-target = " \
            file://0001-Using-native-binaries.patch \