A flaw in Node.js’s permission model network enforcement allows Unix Domain Socket server operations to bypass the required permission checks. When a process is run with the experimental --permission flag but without the --allow-net option, the application can create and expose local interprocess communication endpoints that are not subject to the intended network restrictions. This permits local processes to communicate through these sockets, potentially leaking sensitive data or executing code in the context of other local applications.

Node.js version 25.x processes running with the Permission Model where --allow-net is intentionally omitted. The vulnerability applies only to processes started with the experimental --permission flag while network access remains disabled, affecting users who enforce outbound network restrictions in Node.js 25.x.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. EPSS information is unavailable, so the likelihood of exploitation is uncertain. The likely attack vector is local: an attacker who can run code on the host machine must target a Node.js process configured with --permission and without --allow-net to create Unix Domain Socket endpoints, enabling communication with other local processes and potential data exfiltration or privilege escalation.