A flaw in Node.js permission model enforcement permits the call trace_events.createTracing().enable() to write trace logs outside the directory protected by the --allow-fs-write flag. This incorrect authorization can allow an application to create files in unintended locations, potentially exposing sensitive data or bypassing the intended security boundary. The weakness is classified as CWE-1119, indicating improper authorization, and also matches CWE-1220, a related authorization deficiency involving misuse of configuration.

Node.js versions 22.x, 24.x, and 26.x are affected. Any application running under these releases that enables trace events may be impacted, especially when the process executes under a user account that has directory write permissions.

The CVSS score of 3.3 indicates low to moderate severity, and the EPSS score of less than 1 % signals a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must have code‑execution privileges within the Node.js process or must be able to invoke trace_events.createTracing().enable() through another vulnerability before the file‑write flaw can be exploited. The flaw alone does not provide remote code execution.