This vulnerability in Node.js arises from improper enforcement of the permission model, specifically allowing the process.report feature to write or overwrite files beyond the directories permitted by the --allow-fs-write option. This can result in unauthorized file modifications outside the designated safe paths, potentially exposing confidential information or bypassing intended security restrictions. The issue affects Node.js versions 22.23.1, 24.18.0, and 26.5.0. No official remediation or patch information is currently available, and no known exploits are reported in the wild.

The vulnerability allows a process with limited filesystem write permissions to write or overwrite files outside the allowed paths, potentially leading to confidentiality breaches or circumvention of security boundaries. The impact is limited to confidentiality with no integrity or availability impact reported. The CVSS score of 3.3 reflects a low severity risk, requiring local privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should carefully review and restrict the use of process.report and the --allow-fs-write option to trusted contexts. Monitoring for updates from the Node.js project is recommended.