Loading vulnerability…
CVE-2026-21636 is a permission-model bypass in Node.js v25 affecting the experimental network permission mechanism when the process is started with --permission. The flaw allows Unix Domain Socket connections to evade intended network restrictions, so code can reach local socket endpoints even when network access has not been granted with --allow-net. Attacker-controlled input influencing connection targets, including URL handling or socketPath-style options, can be used through Node.js networking interfaces such as net, tls, and undici/fetch to connect to arbitrary local services over Unix Domain Sockets. This breaks the intended isolation boundary of the Node.js permission model and can expose privileged local services that were expected to be unreachable under the configured restrictions.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a working proof-of-concept exploit for CVE-2026-21636, a Node.js permission model bypass affecting local TCP/UDS connectivity. The repo contains a Python exploit client (exploit.py) and a self-contained vulnerable lab under vuln_server/. The lab launches two Node.js processes under supervisord: a sandboxed Express server (server.mjs) started with --permission --allow-fs-read=/ and no --allow-net, and an unsandboxed helper process (target.cjs). The vulnerable web server exposes GET /pid, which returns the helper PID from /tmp/target.pid, and POST /language, which dynamically imports attacker-controlled input. The exploit abuses the import sink with a data:text/javascript payload to achieve arbitrary JavaScript execution inside the sandboxed process. It then sends SIGUSR1 to the unsandboxed helper process to enable the V8 inspector on 127.0.0.1:9229, uses fetch('http://127.0.0.1:9229/json') and a WebSocket connection to ws://127.0.0.1:9229/<id> from inside the sandboxed process, and leverages the Chrome DevTools Protocol Runtime.evaluate method to run process.mainModule.require('child_process').execSync('cat /app/secret.txt').toString() in the unsandboxed process. This demonstrates that localhost network access succeeds despite the absence of --allow-net, allowing a sandbox escape/pivot to arbitrary command execution. The repository is not part of a known exploit framework, is not merely a detector, and is best classified as an operational PoC with a hardcoded payload and a reproducible Docker environment.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.