Permission model bypass via unchecked Unix Domain Socket connections (CVE-2026-21636)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlleddeps/undici/src/lib/core/connect.js:51

   options = { path: socketPath }

2. 1
   Step 01src/pipe_wrap.cc:228-236

   PipeWrap::Connect calls uv_pipe_connect2 directly without any permission enforcement. Unlike TCP connections which explicitly check permissions, UDS connections bypass this entirely.

   ConnectWrap* req_wrap =
       new ConnectWrap(env, req_wrap_obj, AsyncWrap::PROVIDER_PIPECONNECTWRAP);
   int err = req_wrap->Dispatch(uv_pipe_connect2,
                                &wrap->handle_,
                                *name,
                                name.length(),
                                UV_PIPE_NO_TRUNCATE,
                                AfterConnect);
   

3. 2
   Step 02src/tcp_wrap.cc:272

   For comparison, TCP connect enforces permissions using ERR_ACCESS_DENIED_IF_INSUFFICIENT_PERMISSIONS. This check is absent from the UDS path in pipe_wrap.cc.

   ERR_ACCESS_DENIED_IF_INSUFFICIENT_PERMISSIONS(
       env, permission::PermissionScope::kNet, ip_address.ToStringView(), args);
   

4. 3
   Step 03deps/undici/src/lib/core/connect.js:51,90-96

   Undici connector builds net.connect with the attacker-controlled socketPath, which uses PipeWrap internally and bypasses permission checks.

   const options = { path: socketPath, ...opts }
   // ...
   socket = net.connect({
     highWaterMark: 64 * 1024,
     ...options,
     localAddress,
     port,
     host: hostname
   })
   

5. 4
   Step 04lib/internal/process/pre_execution.js

   Permission model initialization sets up process.permission, but pipe_wrap IPC paths never call ERR_ACCESS_DENIED_IF_INSUFFICIENT_PERMISSIONS, so the model is bypassed for all UDS operations.

   // Permission model sets up kNet scope checks,
   // but PipeWrap never queries them
   

6. Sinksrc/pipe_wrap.cc:216

   PipeWrap::Connect