What is the CVSS score of CVE-2025-54798?

CVE-2025-54798 has a CVSS 3.1 base score of 2.5 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Node.js are affected by CVE-2025-54798?

CVE-2025-54798 is a low-severity vulnerability in tmp (CVSS 2.5). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

Is there a public PoC exploit available for CVE-2025-54798?

Yes, a public proof-of-concept exploit is available for CVE-2025-54798. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-54798?

During next maintenance window: Apply vendor patches when convenient. Vendor patch is available.

Node.js CVE-2025-54798

LOW

Improper Link Resolution Before File Access (CWE-59)

2025-08-07 security-advisories@github.com

Information Disclosure Node.js Tmp

2.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.5 LOW

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:05 vuln.today

Patch released

Mar 28, 2026 - 19:05 nvd

Patch available

PoC Detected

Nov 03, 2025 - 20:19 vuln.today

Public exploit code

CVE Published

Aug 07, 2025 - 01:15 nvd

LOW 2.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

118 npm packages depend on tmp (23 direct, 95 indirect)

Ecosystem-wide dependent count for version 0.2.4.

DescriptionGitHub Advisory

tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.

AnalysisAI

tmp is a temporary file and directory creator for node.js. Rated low severity (CVSS 2.5). Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-59. tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4. Affected products include: Raszi Tmp. Version information: version 0.2.4..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.