Node.js has a flaw in its permission model enforcement where calls to process.report can write or overwrite files beyond directories specified with the --allow-fs-write flag. This weakness, classified as CWE-284 (Improper Authorization) and CWE-73 (Absolute Path Traversal), allows an application to create or modify files outside the intended write boundaries, potentially exposing sensitive data or corrupting critical application files.

The vulnerability targets the nodejs:node product, affecting the 22.x, 24.x, and 26.x release lines.

The CVSS score of 4.4 reflects a low-to-moderate severity, primarily due to the requirement that the attacker control code execution within the Node.js runtime. The EPSS score of < 1% indicates a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a malicious script or module executing within the Node.js environment and invoking process.report with a path that traverses outside the permitted directories. The absence of a publicly available remote exploitation path limits the immediate threat, but the confidentiality impact remains if the attacker can supply arbitrary file paths within the application's process context.