CVE-2026-58039

A flaw was found in Node.js. The permission model enforcement, specifically related to process.report functionality, allows an attacker to write or overwrite files in locations outside of the intended secure paths. This vulnerability can lead to the disclosure of sensitive information or bypass the security boundaries designed to protect the system.

This flaw allows a local user with execution privileges to write or overwrite arbitrary files outside the configured --allow-fs-write paths by triggering process.report. In a practical scenario, an attacker with local script execution rights could leverage this boundary leak to corrupt configuration files or write diagnostic output to restricted locations writable by the service process.

Red Hat scores this vulnerability at 4.4 (Moderate) with Low Integrity impact (I:L), whereas CVEOrg scores it at 3.3 with no Integrity impact (I:N). Red Hat includes Low Integrity because the ability to overwrite existing files on disk alters file state, even if it cannot bypass underlying operating system permissions or escalate privileges to root. The issue remains bounded strictly to Low Confidentiality and Low Integrity (C:L, I:L, A:N).

Systems and applications that do not actively enable Node.js's experimental Permission Model flag (--experimental-permission), or those running untrusted workloads inside standard operating system isolation primitives (such as Linux containers, cgroups, or dedicated system accounts), are not exposed to additional risk from this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid enabling the experimental Node.js Permission Model by not using the --experimental-permission flag. Additionally, ensure that untrusted Node.js workloads are executed within robust operating system isolation primitives, such as Linux containers or cgroups, to limit potential impact.