The vulnerability in Node.js arises from improper enforcement of the permission model related to file system write operations. The trace_events.createTracing().enable() function can write trace logs outside the intended permission scope defined by the --allow-fs-write flag. This flaw affects Node.js versions 22.x, 24.x, and 26.x and may allow unauthorized trace log writes, potentially leading to confidentiality issues or security boundary bypass. The CVSS 3.0 vector indicates a low impact with local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact.

The vulnerability allows trace logs to be written outside the expected permission boundary, which can lead to confidentiality impacts or bypass of security controls related to file system write permissions. The impact is considered low severity, with no known exploits in the wild and no direct availability or confidentiality compromise reported beyond trace log writes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when using trace_events.createTracing().enable() in environments where strict file system write permissions are required. Monitoring for updates from the Node.js project or relevant vendor advisories is recommended.