AIKIDO-2026-10029
node is vulnerable to Path Traversal
85
High Risk
This Affects:
nodeTL;DR
Affected versions of the package allow a permissions bypass in the Node.js Permissions model, where crafted relative symlink paths can circumvent --allow-fs-read and --allow-fs-write restrictions. By chaining directories and symlinks, a script limited to the current directory can escape the permitted path and perform arbitrary file read or write operations, breaking isolation guarantees and potentially leading to system compromise.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
node is vulnerable to Path Traversal in versions 25.0.0 - 25.2.0, 23.0.0 - 24.12.0, 21.0.0 - 22.21.1 and 0.0.1 - 20.19.6.
How to fix this
Upgrade the node library to a patch version.
Links
nodejs.org/en/blog/vulnerability/december-2025-security-releases#bypass-file-system-permissions-using-crafted-symlinks-cve-2025-55130---highnodejs.org/en/blog/vulnerability/december-2025-security-releases
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant