Incorrect Default Permissions

Summary

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the "--allow-fs-write" flag is used. Node.js Permission Model does not operate on file descriptors, however, operations such as "fs.fchown" or "fs.fchmod" can use a "read-only" file descriptor to change the owner and permissions of a file. This vulnerability affects nodejs package versions 20.0.0 through 20.15.0 and 22.0.0 through 22.4.0.