Node.js’s permission model is designed to restrict filesystem access when the process runs with the --permission flag. The flaw leaves fs.realpathSync() without the required read permission checks, allowing code executed under the --permission flag with a restricted --allow-fs-read setting to resolve symbolic links, check for the existence of files, and enumerate directories outside the permitted areas. The type of weakness is a missing access control (CWE-284); based on the description, it is inferred that this breach can expose file names and directory structures, but no remote code execution is supported.

The vulnerability affects Node.js 26.x, 24.x, and 22.x. All compatible binaries are distributed by the Node.js project, and any application running these versions on any operating system where Node.js is installed is exposed when executed with the permission flag.

The CVSS score of 3.3 indicates a low baseline severity, and the EPSS score is < 1%, implying a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need to run Node.js code under the --permission flag with a restricted --allow-fs-read setting. The exploitation yields filesystem enumeration and does not allow arbitrary code execution. The overall risk is moderate for systems that run processes with the permission flag enabled but is mitigated if the flag is unused.