🎯 New Report #3838601: Permission Model Bypass: `trace events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`
🔺Severity: Low
👽 Reporter: 0xoroot
⭐️ Reputation: 922
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-07-02
⏰ Disclosed: 2026-07-29 14:16:11
📝 Summary: A flaw in Node.js Permission Model enforcement was discovered that allowed trace events.createTracing().enable() to write trace logs outside of the --allow-fs-write setting. This vulnerability affected Node.js versions 22.x, 24.x, and 26.x.
📂 Report JSON File: 3838601
@hackeronereports