fs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal attack. This flaw arises from a missing check in the fs.mkdtemp() API and the impact is a malicious actor could create an arbitrary directory.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Impacts:

This vulnerability affects all users using the experimental permission model in Node.js 20.