is RStudio exposed to CVE-2026-111497 via node on Linux?

RStudio IDE
1

My employer's security scanning tool (Qualys) picked up that we had node binaries that haven't been patched for CVE-2026-111497 (see Sysdig write-up). Tried upgrading to the latest (nightly?) version and it indicates still unpatched:

user@hostname:/home/baile320 $ rstudio --version
2026.11.0+5
user@hostname:/home/baile320 $ /usr/lib/rstudio/resources/app/bin/node/bin/node --version
v24.21.0

Based on the security release, Node v24.22.1 (or 26.12.1) fixed this on the node side.

Is there exposure on RStudio's side from including this unpatched binary? Trying to determine whether to assuage my security team's fears or do something else.

Thanks & Best,

EDIT: actually, I'm noticing a Merged PR addressing an updated node version (dunno how I missed it the first time I looked): Update Node.js to 24.22.1 by gtritchie · Pull Request #19211 · rstudio/rstudio · GitHub , so I guess I'll double check my installed version.

EDIT2: 2026.11.0+202 has the updated Node.js version.

2

The bundled /usr/lib/rstudio/resources/app/bin/node/bin/node binary in RStudio Desktop and RStudio Server on Linux is only spawned locally as a helper process for the Quarto Visual Editor (Panmirror) and the optional GitHub Copilot language server over stdio/localhost. It does not bind an external HTTP listener or decompress untrusted network traffic, so your server is not exposed to remote exploitation via CVE-2026-111497.

For your security team's Qualys tracking, Posit already merged the Node v24.22.1 bump in rstudio/rstudio#19211 for the upcoming patch build. If you do not use GitHub Copilot in RStudio and need to silence the path-based Qualys finding on an existing host before upgrading, removing execute permissions on the helper binary (sudo chmod a-x /usr/lib/rstudio/resources/app/bin/node/bin/node) will not affect standard R sessions or console execution.