Riskcovery

CVE-2025-55130

State
Published
Severity
7.1 High
Published
Jan 20, 2026
Updated
Jul 15, 2026
Reserved
Aug 7, 2025

Read the record on cve.org

Description

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.

Scores

CVSSScoreVectorSource
3.07.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nhackerone
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nredhat-SADP

Weaknesses

  • CWE-289 Authentication Bypass by Alternate Name
  • CWE-281 Improper Preservation of Permissions

Affected Products

ProductVersions
nodenodejs
  • 20.19.6 through 20.19.6Affected
  • 22.21.1 through 22.21.1Affected
  • 24.12.0 through 24.12.0Affected
  • 25.2.1 through 25.2.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.