Node.js introduced a permission model that is intended to restrict file system access when the executable is run with the --permission flag. However, the enforcement around fs.realpathSync() is incomplete because the required read permissions are not verified. As a result, code executed under --permission with a restricted --allow-fs-read flag can unexpectedly call fs.realpathSync() to check for file existence, resolve symbolic links, and enumerate file system paths that lie outside of the designated directories. This breach of access control aligns with CWE-284 and can lead to unintended disclosure of file metadata or directory structures, but does not provide remote code execution capabilities.

The vulnerability is present in Node.js versions 26.x, 24.x, and 22.x. All affected binaries are distributed by the Node.js project and affect applications that rely on these runtime versions on any operating system where Node.js is installed.

The CVSS score of 3.3 indicates a low baseline severity, and the EPSS score is not available, implying no current evidence of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to obtain a position to run Node.js code with the --permission flag and a restricted --allow-fs-read setting; this is typically a local privilege escalation or an attacker who can inject or execute code on a system running a vulnerable Node.js process. The exploitation only yields file system enumeration and does not allow arbitrary code execution. The overall risk is moderate for systems that run processes with the permission flag enabled but is mitigated if the flag is unused.