The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: --allow-fs-read=/home/node/.ssh/*.pub will ignore pub and give access to everything after .ssh/.

Impacts:
This misleading documentation affects all users using the experimental permission model in active release lines: 20.x and 21.x.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.