This vulnerability arises from a flaw in the enforcement of the Node.js permission model under the --permission flag. Specifically, the issue is that the boundary handling of filesystem paths using a radix-tree prefix structure is flawed, allowing an attacker who has been granted access to a particular filesystem path to bypass restrictions and access other paths outside the intended allowlist. This improper access control (CWE-284) can lead to unauthorized read and write operations on the filesystem. The affected versions explicitly include Node.js 22.23.1, 24.18.0, and 26.5.0, as well as the main development branch. The CVSS 3.0 score is 7.5, indicating high severity, with an attack vector local, high attack complexity, low privileges required, no user interaction, scope changed, and high impact on confidentiality and integrity but no impact on availability. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation allows an attacker with limited filesystem permissions to escalate their access beyond the intended scope, potentially reading or modifying sensitive files outside the authorized directories. This compromises confidentiality and integrity of the filesystem data accessible to the Node.js process. There is no indication of availability impact. The vulnerability affects local users with some privileges, requiring high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should carefully restrict permissions granted under the --permission flag and avoid running untrusted code with elevated filesystem access. Monitor official Node.js channels for updates and apply patches promptly once available.