[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2025-55130":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T11:19:25.255Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":25,"aliases":26,"duplicate_of":9,"upstream":27,"downstream":28,"duplicates":93,"related":94,"reserved_at":9,"published_at":107,"modified_at":108,"state":109,"summary":110,"references_raw":119,"kevs":207,"epss":208,"epss_history":211,"metrics":473,"affected":488},"CVE-2025-55130","A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.\nThis vulnerability affects users of the permission model on Node.js v20,  v22,  v24, and v25.",null,[11,19],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-289","Authentication Bypass by Alternate Name","The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.","weakness","Incomplete","Base",[],{"_key":20,"id":20,"name":21,"description":22,"type":15,"status":23,"abstraction":17,"likelihood_of_exploit":9,"capec":24},"CWE-281","Improper Preservation of Permissions","The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.","Draft",[],[],[],[],[29,31,33,35,37,39,41,43,45,47,49,51,53,55,57,59,61,63,65,67,69,71,73,75,77,79,81,83,85,87,89,91],{"_key":30},"SUSE-SU-2026:0301-1",{"_key":32},"SUSE-SU-2026:0457-1",{"_key":34},"SUSE-SU-2026:20436-1",{"_key":36},"DSA-6166-1",{"_key":38},"SUSE-SU-2026:0295-1",{"_key":40},"SUSE-SU-2026:0435-1",{"_key":42},"OPENSUSE-SU-2026:10062-1",{"_key":44},"OPENSUSE-SU-2026:10074-1",{"_key":46},"OPENSUSE-SU-2026:20236-1",{"_key":48},"MGASA-2026-0009",{"_key":50},"ALPINE-CVE-2025-55130",{"_key":52},"DEBIAN-CVE-2025-55130",{"_key":54},"OPENSUSE-SU-2026:11110-1",{"_key":56},"RHSA-2026:1842",{"_key":58},"RHSA-2026:1843",{"_key":60},"RHSA-2026:2420",{"_key":62},"RHSA-2026:2421",{"_key":64},"RHSA-2026:2422",{"_key":66},"RHSA-2026:2767",{"_key":68},"RHSA-2026:2768",{"_key":70},"RHSA-2026:2781",{"_key":72},"RHSA-2026:2782",{"_key":74},"RHSA-2026:2783",{"_key":76},"RHSA-2026:2864",{"_key":78},"RHSA-2026:2899",{"_key":80},"RHSA-2026:6402",{"_key":82},"RHSA-2026:6431",{"_key":84},"RHSA-2026:7378",{"_key":86},"RHSA-2026:7386",{"_key":88},"RHSA-2026:7387",{"_key":90},"RHSA-2026:7657",{"_key":92},"UBUNTU-CVE-2025-55130",[],[95,96,97,98,99,100,101,102,103,104,105],{"_key":30},{"_key":32},{"_key":34},{"_key":38},{"_key":40},{"_key":42},{"_key":44},{"_key":46},{"_key":48},{"_key":54},{"_key":106},"CGA-Q5RV-5G79-M742","2026-01-20T20:41:55.393Z","2026-07-15T01:26:03.446Z","Analyzed",{"cisa_kev":111,"cisa_ransomware":111,"cisa_vendor":9,"epss_severity":112,"epss_score":113,"severity":114,"severity_score":115,"severity_version":116,"severity_source":117,"severity_vector":118,"severity_status":109},false,"low",0.01633,"critical",9.1,"v3.1","nvd","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",[120,127,133,138,143,147,151,155,159,163,167,171,175,179,183,187,191,195,199,203],{"url":121,"sources":122,"tags":124},"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases",[123,117],"cve.org",[125,126],"Release Notes","Vendor Advisory",{"url":128,"sources":129,"tags":130},"https://access.redhat.com/security/cve/CVE-2025-55130",[123],[131,132],"VDB Entry","X Refsource REDHAT",{"url":134,"sources":135,"tags":136},"https://bugzilla.redhat.com/show_bug.cgi?id=2431352",[123],[137,132],"Issue Tracking",{"url":139,"sources":140,"tags":141},"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-55130.json",[123],[142],"X Sadp Csaf Vex",{"url":144,"sources":145,"tags":146},"https://access.redhat.com/errata/RHSA-2026:2899",[123],[126,132],{"url":148,"sources":149,"tags":150},"https://access.redhat.com/errata/RHSA-2026:1843",[123],[126,132],{"url":152,"sources":153,"tags":154},"https://access.redhat.com/errata/RHSA-2026:1842",[123],[126,132],{"url":156,"sources":157,"tags":158},"https://access.redhat.com/errata/RHSA-2026:2422",[123],[126,132],{"url":160,"sources":161,"tags":162},"https://access.redhat.com/errata/RHSA-2026:2421",[123],[126,132],{"url":164,"sources":165,"tags":166},"https://access.redhat.com/errata/RHSA-2026:2420",[123],[126,132],{"url":168,"sources":169,"tags":170},"https://access.redhat.com/errata/RHSA-2026:2768",[123],[126,132],{"url":172,"sources":173,"tags":174},"https://access.redhat.com/errata/RHSA-2026:2767",[123],[126,132],{"url":176,"sources":177,"tags":178},"https://access.redhat.com/errata/RHSA-2026:2864",[123],[126,132],{"url":180,"sources":181,"tags":182},"https://access.redhat.com/errata/RHSA-2026:2783",[123],[126,132],{"url":184,"sources":185,"tags":186},"https://access.redhat.com/errata/RHSA-2026:2782",[123],[126,132],{"url":188,"sources":189,"tags":190},"https://access.redhat.com/errata/RHSA-2026:2781",[123],[126,132],{"url":192,"sources":193,"tags":194},"https://access.redhat.com/errata/RHSA-2026:7386",[123],[126,132],{"url":196,"sources":197,"tags":198},"https://access.redhat.com/errata/RHSA-2026:7387",[123],[126,132],{"url":200,"sources":201,"tags":202},"https://access.redhat.com/errata/RHSA-2026:6402",[123],[126,132],{"url":204,"sources":205,"tags":206},"https://access.redhat.com/errata/RHSA-2026:6431",[123],[126,132],[],{"date":209,"score":113,"percentile":210},"2026-07-05",0.73389,[212,216,219,221,224,228,231,234,236,238,241,244,247,249,251,255,258,261,264,267,270,272,275,278,281,284,287,290,293,297,300,303,306,309,312,315,318,321,324,326,329,332,335,338,341,344,347,350,353,356,358,361,364,367,370,373,376,379,382,384,388,390,393,396,399,402,405,407,411,414,417,420,423,426,428,431,434,437,440,443,446,449,452,455,458,460,462,465,467,470],{"date":213,"score":214,"percentile":215},"2026-01-21",0.00005,0.00199,{"date":217,"score":214,"percentile":218},"2026-01-22",0.00177,{"date":220,"score":214,"percentile":218},"2026-01-23",{"date":222,"score":214,"percentile":223},"2026-01-24",0.00178,{"date":225,"score":226,"percentile":227},"2026-01-25",0.00004,0.00171,{"date":229,"score":214,"percentile":230},"2026-01-26",0.00201,{"date":232,"score":214,"percentile":233},"2026-01-27",0.002,{"date":235,"score":214,"percentile":233},"2026-01-28",{"date":237,"score":214,"percentile":233},"2026-01-29",{"date":239,"score":214,"percentile":240},"2026-01-30",0.00202,{"date":242,"score":214,"percentile":243},"2026-01-31",0.00203,{"date":245,"score":214,"percentile":246},"2026-02-01",0.00217,{"date":248,"score":214,"percentile":246},"2026-02-02",{"date":250,"score":214,"percentile":246},"2026-02-03",{"date":252,"score":253,"percentile":254},"2026-02-04",0.00011,0.01,{"date":256,"score":253,"percentile":257},"2026-02-05",0.01005,{"date":259,"score":253,"percentile":260},"2026-02-06",0.01019,{"date":262,"score":253,"percentile":263},"2026-02-07",0.01033,{"date":265,"score":253,"percentile":266},"2026-02-08",0.01038,{"date":268,"score":253,"percentile":269},"2026-02-09",0.01035,{"date":271,"score":253,"percentile":269},"2026-02-10",{"date":273,"score":253,"percentile":274},"2026-02-11",0.01075,{"date":276,"score":253,"percentile":277},"2026-02-12",0.01096,{"date":279,"score":253,"percentile":280},"2026-02-13",0.011,{"date":282,"score":253,"percentile":283},"2026-02-14",0.01109,{"date":285,"score":253,"percentile":286},"2026-02-15",0.01116,{"date":288,"score":253,"percentile":289},"2026-02-16",0.01113,{"date":291,"score":253,"percentile":292},"2026-02-17",0.01099,{"date":294,"score":295,"percentile":296},"2026-02-18",0.00012,0.01755,{"date":298,"score":295,"percentile":299},"2026-02-19",0.01762,{"date":301,"score":253,"percentile":302},"2026-02-20",0.01207,{"date":304,"score":295,"percentile":305},"2026-02-21",0.0173,{"date":307,"score":295,"percentile":308},"2026-02-22",0.01728,{"date":310,"score":295,"percentile":311},"2026-02-23",0.01666,{"date":313,"score":295,"percentile":314},"2026-02-24",0.01634,{"date":316,"score":295,"percentile":317},"2026-02-25",0.01618,{"date":319,"score":295,"percentile":320},"2026-02-26",0.01584,{"date":322,"score":295,"percentile":323},"2026-02-27",0.0162,{"date":325,"score":295,"percentile":317},"2026-02-28",{"date":327,"score":295,"percentile":328},"2026-03-01",0.01808,{"date":330,"score":295,"percentile":331},"2026-03-02",0.01831,{"date":333,"score":295,"percentile":334},"2026-03-03",0.01843,{"date":336,"score":295,"percentile":337},"2026-03-04",0.01652,{"date":339,"score":295,"percentile":340},"2026-03-05",0.01689,{"date":342,"score":295,"percentile":343},"2026-03-06",0.01684,{"date":345,"score":295,"percentile":346},"2026-03-07",0.01682,{"date":348,"score":295,"percentile":349},"2026-03-08",0.01678,{"date":351,"score":295,"percentile":352},"2026-03-09",0.01668,{"date":354,"score":295,"percentile":355},"2026-03-10",0.01661,{"date":357,"score":295,"percentile":323},"2026-03-11",{"date":359,"score":295,"percentile":360},"2026-03-12",0.0163,{"date":362,"score":295,"percentile":363},"2026-03-13",0.01621,{"date":365,"score":295,"percentile":366},"2026-03-14",0.01585,{"date":368,"score":295,"percentile":369},"2026-03-15",0.01573,{"date":371,"score":295,"percentile":372},"2026-03-16",0.01567,{"date":374,"score":295,"percentile":375},"2026-03-17",0.01538,{"date":377,"score":295,"percentile":378},"2026-03-18",0.01535,{"date":380,"score":295,"percentile":381},"2026-03-19",0.01532,{"date":383,"score":295,"percentile":381},"2026-03-20",{"date":385,"score":386,"percentile":387},"2026-03-21",0.00013,0.01998,{"date":389,"score":386,"percentile":387},"2026-03-22",{"date":391,"score":386,"percentile":392},"2026-03-23",0.01994,{"date":394,"score":386,"percentile":395},"2026-03-24",0.01983,{"date":397,"score":386,"percentile":398},"2026-03-25",0.01977,{"date":400,"score":386,"percentile":401},"2026-03-26",0.01986,{"date":403,"score":386,"percentile":404},"2026-03-27",0.01991,{"date":406,"score":386,"percentile":404},"2026-03-28",{"date":408,"score":409,"percentile":410},"2026-03-29",0.00015,0.02916,{"date":412,"score":409,"percentile":413},"2026-03-30",0.02905,{"date":415,"score":409,"percentile":416},"2026-03-31",0.02892,{"date":418,"score":409,"percentile":419},"2026-04-01",0.02888,{"date":421,"score":409,"percentile":422},"2026-04-02",0.02953,{"date":424,"score":409,"percentile":425},"2026-04-03",0.02968,{"date":427,"score":409,"percentile":425},"2026-04-04",{"date":429,"score":409,"percentile":430},"2026-04-05",0.02969,{"date":432,"score":409,"percentile":433},"2026-04-06",0.0297,{"date":435,"score":409,"percentile":436},"2026-04-07",0.02976,{"date":438,"score":409,"percentile":439},"2026-04-08",0.02977,{"date":441,"score":409,"percentile":442},"2026-04-09",0.03002,{"date":444,"score":409,"percentile":445},"2026-04-10",0.02993,{"date":447,"score":409,"percentile":448},"2026-04-11",0.02964,{"date":450,"score":409,"percentile":451},"2026-04-12",0.02941,{"date":453,"score":409,"percentile":454},"2026-04-13",0.02932,{"date":456,"score":409,"percentile":457},"2026-04-14",0.02906,{"date":459,"score":409,"percentile":419},"2026-04-15",{"date":461,"score":409,"percentile":457},"2026-04-16",{"date":463,"score":409,"percentile":464},"2026-04-17",0.02915,{"date":466,"score":409,"percentile":410},"2026-04-18",{"date":468,"score":409,"percentile":469},"2026-04-19",0.02909,{"date":471,"score":409,"percentile":472},"2026-04-20",0.02898,[474,483],{"source":123,"cvss_v2_0":9,"cvss_v3_0":475,"cvss_v3_1":481,"cvss_v4_0":9},{"baseScore":476,"baseSeverity":477,"vectorString":478,"impactScore":479,"exploitabilityScore":480},7.1,"HIGH","CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",8.7,4.6,{"baseScore":476,"baseSeverity":477,"vectorString":482,"impactScore":479,"exploitabilityScore":480},"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",{"source":117,"cvss_v2_0":9,"cvss_v3_0":484,"cvss_v3_1":485,"cvss_v4_0":9},{"baseScore":476,"baseSeverity":477,"vectorString":478,"impactScore":479,"exploitabilityScore":480},{"baseScore":115,"baseSeverity":486,"vectorString":118,"impactScore":479,"exploitabilityScore":487},"CRITICAL",10,[489,508],{"ecosystem":9,"name":490,"vendor":491,"product":490,"cpe_part":492,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":493},"node","nodejs","a",[494,499,502,505],{"version":495,"is_range":496,"range_type":123,"version_start":497,"version_start_type":498,"version_end":497,"version_end_type":498,"fixed_in":9},">= 20.19.6, \u003C= 20.19.6",true,"20.19.6","including",{"version":500,"is_range":496,"range_type":123,"version_start":501,"version_start_type":498,"version_end":501,"version_end_type":498,"fixed_in":9},">= 22.21.1, \u003C= 22.21.1","22.21.1",{"version":503,"is_range":496,"range_type":123,"version_start":504,"version_start_type":498,"version_end":504,"version_end_type":498,"fixed_in":9},">= 24.12.0, \u003C= 24.12.0","24.12.0",{"version":506,"is_range":496,"range_type":123,"version_start":507,"version_start_type":498,"version_end":507,"version_end_type":498,"fixed_in":9},">= 25.2.1, \u003C= 25.2.1","25.2.1",{"ecosystem":9,"name":509,"vendor":491,"product":509,"cpe_part":492,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":510},"node.js",[511,517,521,525],{"version":512,"is_range":496,"range_type":513,"version_start":514,"version_start_type":498,"version_end":515,"version_end_type":516,"fixed_in":9},"gte20.0.0_lt20.20.0","cpe","20.0.0","20.20.0","excluding",{"version":518,"is_range":496,"range_type":513,"version_start":519,"version_start_type":498,"version_end":520,"version_end_type":516,"fixed_in":9},"gte22.0.0_lt22.22.0","22.0.0","22.22.0",{"version":522,"is_range":496,"range_type":513,"version_start":523,"version_start_type":498,"version_end":524,"version_end_type":516,"fixed_in":9},"gte24.0.0_lt24.13.0","24.0.0","24.13.0",{"version":526,"is_range":496,"range_type":513,"version_start":527,"version_start_type":498,"version_end":528,"version_end_type":516,"fixed_in":9},"gte25.0.0_lt25.3.0","25.0.0","25.3.0"]