CVE-2025-55130
A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.
This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
| Software | From | Fixed in |
|---|---|---|
| nodejs / node.js | 20.0.0 | 20.20.0 |
| nodejs / node.js | 22.0.0 | 22.22.0 |
| nodejs / node.js | 24.0.0 | 24.13.0 |
| nodejs / node.js | 25.0.0 | 25.3.0 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime