CVE-2026-48617 is a vulnerability in Node.js's experimental Permission Model, which restricts filesystem, network, and process access when enabled via the --permission flag. The flaw arises from insufficient path validation in the process.report.writeReport() function, allowing an attacker to bypass intended security boundaries and write diagnostic reports to unauthorized locations. This can lead to unauthorized information disclosure under specific configurations. The vulnerability is low severity and only affects systems with the Permission Model enabled. Fixed Node.js releases 22.23.0, 24.17.0, and 26.3.1 and later address this issue. Red Hat Hardened Images include updated RPMs to remediate this vulnerability.

The vulnerability allows bypassing the Permission Model's enforcement, enabling code with restricted permissions to write diagnostic reports outside the configured allow-list. This can result in low-severity information disclosure. The flaw does not affect Node.js when the Permission Model is not enabled. There are no known exploits in the wild. The impact is limited to confidentiality under specific configurations.

A fix is available. Users relying on the Permission Model should upgrade to Node.js versions 22.23.0, 24.17.0, or 26.3.1 and later as provided by their downstream vendors, including Red Hat Hardened Images RPM updates. No workaround is available for restricting process.report.writeReport() output paths. Applying the update is the recommended mitigation.