Vulnerability Description
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nodejs | Node.Js | >= 20.0.0, < 20.20.0 |
Related Weaknesses (CWE)
References
- https://nodejs.org/en/blog/vulnerability/december-2025-security-releasesRelease NotesVendor Advisory
FAQ
What is CVE-2025-55130?
CVE-2025-55130 is a vulnerability with a CVSS score of 9.1 (CRITICAL). A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a scr...
How severe is CVE-2025-55130?
CVE-2025-55130 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-55130?
Check the references section above for vendor advisories and patch information. Affected products include: Nodejs Node.Js.