CVE-2026-48617 is a security flaw in Node.js's experimental Permission Model, which restricts filesystem, network, and process access when enabled. The vulnerability arises from insufficient path validation in the process.report.writeReport() function, allowing an attacker with restricted permissions to write diagnostic reports to unauthorized locations outside the configured allow-list. This can lead to low-severity information disclosure under specific configurations. The vulnerability does not affect Node.js when the Permission Model is not enabled. Red Hat has issued a security advisory (RHSA-2026:46197) including updated Node.js 24.18.0-0.6.hum1 RPM packages as a fix. Users should upgrade to fixed Node.js versions 22.23.0, 24.17.0, or 26.3.1 and later as they become available downstream. No workaround exists for this issue.

The vulnerability allows bypassing the Permission Model's enforcement, potentially enabling unauthorized writing of diagnostic reports to locations outside the allowed paths. This may lead to low-severity information disclosure. The impact is limited to Node.js instances with the Permission Model enabled. Default Node.js configurations without the Permission Model are not affected. There are no known exploits in the wild. The vulnerability has a low severity rating.

Users relying on the Node.js experimental Permission Model should upgrade to fixed Node.js releases (22.23.0, 24.17.0, or 26.3.1 and later) as they become available downstream. No workaround is available for restricting process.report.writeReport() output paths. Applying the updated Red Hat Hardened Images RPMs containing the fixed Node.js packages is recommended to remediate this issue.