When a debug flag is used, the software starts the Node.js Inspector but ignores the explicit bind address provided by the user. Instead of binding to the intended loopback address, it binds to a broadly reachable address, exposing the debugging interface beyond the local machine. Since the Inspector protocol allows arbitrary code evaluation, a remote party with access to this interface can achieve remote code execution on the developer's machine.