Quick answers
- Is CVE-2025-54798 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-54798 being exploited in the wild.
- How severe is CVE-2025-54798?
- Low severity, with a CVSS score of 3.1, published 6 August 2025.
- Which products and versions are affected?
- tmp (npm) < 0.2.4.
- Is there a fix for CVE-2025-54798?
- A patch was published on 2025-08-06: Fixed in version 0.2.4 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-54798 attacked?
- It is attacked with local access.
- Am I affected by CVE-2025-54798?
- Check whether you run tmp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a symlink-following bug (CWE-59) in the path validation logic of npm tmp. The `_resolvePath()` function fails to resolve symbolic links when checking whether a path remains within the system's temporary directory. If the `dir` parameter is a symlink pointing outside tmpdir, the check in `_assertIsRelative()` can be bypassed because it validates the unresolved path rather than the real resolved path. An attacker with local filesystem access can create a symlink inside tmpdir that points to an external directory, then pass this symlink as the `dir` parameter to create files outside the intended security boundary. This requires low privileges and system-level filesystem write permissions, but no user interaction. The fix, available in version 0.2.4 and later, involves calling `fs.realpathSync()` to resolve symlinks before validation.
Affected products
- npm tmp < 0.2.4
Identifiers
- CVE-2025-54798
- GHSA-52f5-9888-hmc6
Timeline
- 2025-08-06: disclosed
- 2025-08-06: patched: Fixed in version 0.2.4 and later