CVE-2025-55130: FS Permissions Bypass
A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.
Other sources
A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.20.0Fixed in 22.22.0Fixed in 24.13.0Fixed in 25.3.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.20.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.22.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.13.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.3.0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2025-55130?
CVE-2025-55130 is considered a significant security vulnerability due to its potential to allow unauthorized access to file system resources.
How do I fix CVE-2025-55130?
To remediate CVE-2025-55130, upgrade Node.js to version 26.0.0 or later, where the flaw has been addressed.
Which versions of Node.js are affected by CVE-2025-55130?
CVE-2025-55130 affects Node.js versions from 20.0.0 to 26.0.0.
What are the risks associated with CVE-2025-55130?
The risks include the potential for attackers to bypass file system permission restrictions and access sensitive data.
Is CVE-2025-55130 part of a larger vulnerability series?
Yes, CVE-2025-55130 is part of a series of related vulnerabilities in Node.js's permissions model.