CVE-2025-55130
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
A flaw in Node.js's Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files.
Risk Assessment
The risk involves breaking the isolation guarantees of the permission model, potentially leading to unauthorized file read/write and system compromise.
Recommendation
Immediately update Node.js to a patched version (v20.x, v22.x, v24.x, v25.x with fix) and restrict the use of symbolic links in production environments.
Original NVD description (English source)
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.