This vulnerability in Node.js arises from improper access control (CWE-284) related to the permission model enforcement. Specifically, the process.report.writeReport() function's path validation can be bypassed, potentially allowing unauthorized actions that compromise confidentiality or security boundaries. The issue affects exact versions 22.22.3, 24.16.0, and 26.3.0 of Node.js. The CVSS v3.0 score is 1.8, indicating low severity, with attack vector local, high attack complexity, required privileges high, user interaction required, and no impact on confidentiality, integrity, or availability as per the vector string. There is no vendor advisory or patch information available at this time.

The vulnerability could allow bypassing intended security boundaries or confidentiality protections in affected Node.js versions. However, the low CVSS score and vector indicate that exploitation requires local access with high privileges and user interaction, limiting the practical impact. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid running affected versions in sensitive environments or apply additional access controls to limit exposure. Monitor official Node.js channels for updates.