{"id":"CVE-2025-55130","title":"A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths","summary":"A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the curren…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-289","CWE-281"],"vendor":"nodejs","product":"node.js","affected":["node.js >= 20.0.0, < 20.20.0","node.js >= 22.0.0, < 22.22.0","node.js >= 24.0.0, < 24.13.0","node.js >= 25.0.0, < 25.3.0"],"patched":["node.js 25.3.0"],"published":"2026-01-20","updated":"2026-06-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-55130","references":[{"url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","label":"support@hackerone.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:1842","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:1843","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2420","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2421","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2422","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2767","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2768","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2781","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2782","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2783","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2864","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2899","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6402","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6431","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7386","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7387","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2025-55130","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431352","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-55130.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"tags":["nvd","exploit-available"],"epss":0.01723,"epssPercentile":0.76175,"ingestedAt":"2026-06-30T13:26:50.521Z","exploits":{"github":1,"githubRepos":["https://github.com/scumfrog/CVE-2025-55130"],"checkedAt":"2026-09-21T15:27:44.980Z"},"exploitAvailable":true,"slug":"CVE-2025-55130","body":"## Overview\n\nA flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.\nThis vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.\n\n## Affected\n\n- `node.js >= 20.0.0, < 20.20.0`\n- `node.js >= 22.0.0, < 22.22.0`\n- `node.js >= 24.0.0, < 24.13.0`\n- `node.js >= 25.0.0, < 25.3.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `node.js 25.3.0`","depth":"abyssal","depthScore":62,"depthScoreParts":{"impact":50.1,"likelihood":0.3,"exploitation":12,"ransomware":0},"changes":[{"seq":4890,"id":"CVE-2025-55130","ts":1788887215083,"field":"exploit_available","old":"false","new":"true"},{"seq":3773,"id":"CVE-2025-55130","ts":1788886334627,"field":"exploit_available","old":"true","new":"false"},{"seq":2618,"id":"CVE-2025-55130","ts":1788883012903,"field":"exploit_available","old":"false","new":"true"},{"seq":1647,"id":"CVE-2025-55130","ts":1788882417243,"field":"exploit_available","old":"true","new":"false"},{"seq":755,"id":"CVE-2025-55130","ts":1788881850546,"field":"exploit_available","old":"false","new":"true"}]}