Nodejs: A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. (CVE-2026-58039)

CVE-2026-58039 describes a flaw in the Node.js permission model enforcement where the process.report functionality can write or overwrite files outside the paths explicitly allowed by the --allow-fs-write option. This behavior violates the intended security boundary, potentially exposing confidential data or allowing unauthorized file modifications. The vulnerability affects Node.js versions 22.x, 24.x, and 26.x. The CVSS 3.0 base score is 3.3, reflecting a low impact on confidentiality and no impact on integrity or availability. No known exploits are reported in the wild, and no patch or remediation details are provided in the input data.

The vulnerability allows unauthorized writes or overwrites of files outside the intended allowed filesystem paths via process.report, which can lead to confidentiality breaches or bypass of security boundaries. The impact is limited to confidentiality with no reported integrity or availability impact. The CVSS score of 3.3 (medium severity) reflects this limited impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should carefully restrict the use of process.report and the --allow-fs-write option to trusted contexts and monitor configurations to minimize exposure.