UpHeron
All vulnerabilities

Servers and applications

CVE-2025-55130

Bypass File System Permissions using crafted symlinks

Severity
Critical 9.1
Published
13 Jan 2026
Last changed
15 Jul 2026
Added to UpHeron
21 Oct 2026
Fixed in
20.20.0, 22.22.0, 24.13.0, 25.3.0
Sources
NVD, nodejs

Description

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to…

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 20.0.0 before 20.20.0
  • From 22.0.0 before 22.22.0
  • From 24.0.0 before 24.13.0
  • From 25.0.0 before 25.3.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-55130
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-55130
  • Node.js security release https://nodejs.org/en/blog/vulnerability/december-2025-security-releases