CVE-2025-55130 Details
Description
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
A vulnerability in Node.js's permissions model enables attackers to circumvent '--allow-fs-read' and '--allow-fs-write' restrictions by using manipulated relative symlink paths. This issue is present in Node.js versions 20.x, 22.x, 24.x, and 25.x. By chaining directories and symlinks, a script with access limited to the current directory can escape the designated path and access sensitive files. This behavior undermines the expected isolation and allows arbitrary reading or writing of files, potentially leading to system compromise.
Users can upgrade to Node.js versions 20.20.0, 22.22.0, 24.13.0, or 25.4.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-281 | Improper Preservation of Permissions | redhat-SADP |
| CWE-289 | Authentication Bypass by Alternate Name | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| nodejs node.js | >= 20.0.0, < 20.20.0 >= 22.0.0, < 22.22.0 >= 24.0.0, < 24.13.0 >= 25.0.0, < 25.3.0 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Feb 3, 2026 | Initial Analysis | [email protected] |
| Jan 21, 2026 | CVE Modified | CISA-ADP |
| Jan 20, 2026 | New CVE Received | [email protected] |