CVE-2025-55130
Summary
| CVE | CVE-2025-55130 |
|---|---|
| State | PUBLISHED |
| Assigner | hackerone |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-01-20 21:16:03 UTC |
| Updated | 2026-07-15 02:17:27 UTC |
| Description | A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25. |
Risk And Classification
Primary CVSS: v3.1 9.1 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Problem Types: CWE-289 | CWE-281 | CWE-289 CWE-289 Authentication Bypass by Alternate Name | CWE-281 Improper Preservation of Permissions
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | ADP | CVSS | 7.1 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.1 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| 3.0 | [email protected] | Secondary | 7.1 | HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| 3.0 | CNA | DECLARED | 7.1 | HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v3.0 Breakdown
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Nodejs | Node | affected 20.19.6 20.19.6 semver | Not specified |
| CNA | Nodejs | Node | affected 22.21.1 22.21.1 semver | Not specified |
| CNA | Nodejs | Node | affected 24.12.0 24.12.0 semver | Not specified |
| CNA | Nodejs | Node | affected 25.2.1 25.2.1 semver | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10 | unaffected 1:24.13.0-1.el10_1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10 | unaffected 1:22.22.0-3.el10_1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | unaffected 1:22.22.0-1.el10_0 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8 | unaffected 8100020260116121421.6d880403 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8 | unaffected 8100020260119091831.6d880403 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8 | unaffected 8100020260119100525.489197e6 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | unaffected 9070020260117213814.rhel9 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | unaffected 9070020260117213838.rhel9 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | unaffected 9070020260117213748.rhel9 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | unaffected 9040020260211171433.rhel9 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | unaffected 9060020260210180816.rhel9 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | unaffected 9060020260210120402.rhel9 * rpm | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | unaffected 24.14.1-4.1.hum1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | unaffected 24.14.1-4.hum1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | unaffected 25.9.0-1.1.hum1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | unaffected 25.9.0-1.hum1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | unaffected 20.20.0-7.1.hum1 * rpm | Not specified |
| ADP | Red Hat | Red Hat Hardened Images | unaffected 22.22.0-1.3.hum1 * rpm | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:7386 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:6402 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-55130.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:2768 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:2899 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:1843 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:2420 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:2422 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:2781 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:2783 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:2421 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:1842 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:2782 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:2864 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| nodejs.org/en/blog/vulnerability/december-2025-security-releases | [email protected] | nodejs.org | Release Notes, Vendor Advisory |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:2767 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:7387 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2025-55130 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:6431 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-01-20T21:03:01.083Z | Reported to Red Hat. |
| ADP | 2026-01-20T20:41:55.393Z | Made public. |
Solutions
ADP: RHSA-2026:2899: Red Hat Enterprise Linux AppStream EUS (v. 10.0)
ADP: RHSA-2026:1843: Red Hat Enterprise Linux AppStream (v. 10)
ADP: RHSA-2026:1842: Red Hat Enterprise Linux AppStream (v. 10)
ADP: RHSA-2026:2422: Red Hat Enterprise Linux AppStream (v. 8)
ADP: RHSA-2026:2421: Red Hat Enterprise Linux AppStream (v. 8)
ADP: RHSA-2026:2420: Red Hat Enterprise Linux AppStream (v. 8)
ADP: RHSA-2026:2768: Red Hat Enterprise Linux AppStream EUS (v.9.4)
ADP: RHSA-2026:2767: Red Hat Enterprise Linux AppStream EUS (v.9.6)
ADP: RHSA-2026:2864: Red Hat Enterprise Linux AppStream EUS (v.9.6)
ADP: RHSA-2026:2783: Red Hat Enterprise Linux AppStream (v. 9)
ADP: RHSA-2026:2782: Red Hat Enterprise Linux AppStream (v. 9)
ADP: RHSA-2026:2781: Red Hat Enterprise Linux AppStream (v. 9)
ADP: RHSA-2026:7386: Red Hat Hardened Images
ADP: RHSA-2026:7387: Red Hat Hardened Images
ADP: RHSA-2026:6402: Red Hat Hardened Images
ADP: RHSA-2026:6431: Red Hat Hardened Images
Workarounds
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.