A weakness in Node.js’ Permission Model causes the native realpath function to bypass read permission checks, enabling code running with the --permission flag and restricted --allow-fs-read to discover the existence of files, resolve symbolic links, and enumerate paths outside the permitted directories. The flaw can reveal sensitive directory structures and file names that should remain hidden, constituting an information disclosure vulnerability. The core weakness is a missing authentication check in filesystem access, which falls under the category of improper access control.

The defect affects nodejs node versions 20.x, 22.x, 24.x, and 25.x when the Permission Model is enabled and the filesystem read permission flag is intentionally restricted. Any application running under these conditions can potentially probe for files beyond their safe area.

With a CVSS score of 3.3, the vulnerability is rated low severity. It can be exploited locally by any code that can run JavaScript within the restricted permission context. The attack does not require network access or administrative privileges; it merely requires the ability to execute code under the permission model. The impact is limited to revealing filesystem information and does not lead to code execution or denial of service. The vulnerability is not currently listed in the known-exploited-vulnerabilities catalog.