This vulnerability in Node.js arises from a flaw in the enforcement of its permission model, specifically related to process.report functionality. The flaw permits writing and overwriting files outside the paths explicitly allowed by the --allow-fs-write option. This improper access control (CWE-284) can result in confidentiality breaches by circumventing security boundaries. The issue affects Node.js versions 22.23.1, 24.18.0, and 26.5.0. The CVSS 3.0 score is 3.3, indicating low severity with local attack vector, low complexity, requiring low privileges, no user interaction, and limited confidentiality impact. There is no known exploit in the wild and no vendor-provided patch or official remediation level at this time.

The vulnerability allows an attacker with local privileges to write or overwrite files outside the intended filesystem write boundaries, potentially exposing confidential information or bypassing security restrictions. However, the impact is limited to confidentiality with no integrity or availability effects reported. The low CVSS score reflects the limited scope and complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should carefully restrict local access to Node.js environments and avoid configurations that expose process.report with elevated filesystem write permissions. Monitor vendor channels for updates and apply patches promptly once available.