CVE-2025-55130
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3Description
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.
Analysis
Node.js has a permissions model bypass that allows attackers to circumvent --allow-fs-read and --allow-fs-write restrictions using alternate path representations.
Technical Context
Node.js's experimental permissions model can be bypassed (CWE-289) by using alternate file path representations that the permission check doesn't normalize, allowing reads and writes to restricted paths.
Affected Products
['Node.js (versions using experimental permissions model)']
Remediation
Update Node.js. Do not rely solely on the experimental permissions model for security-critical sandboxing.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today