CVE-2025-54798 Overview
CVE-2025-54798 affects the tmp npm package, a widely used temporary file and directory creator for Node.js maintained by raszi. Versions 0.2.3 and below permit an arbitrary temporary file or directory write through a symbolic link supplied via the dir parameter. The flaw is tracked under CWE-59: Improper Link Resolution Before File Access and is fixed in version 0.2.4. Because tmp is a transitive dependency of many Node.js tooling chains, downstream applications inherit the risk without explicit awareness.
Critical Impact
Attackers controlling the dir parameter can redirect file or directory creation outside the intended temporary path, enabling integrity violations against arbitrary filesystem locations writable by the Node.js process.
Affected Products
- raszi/tmp versions 0.2.3 and below (Node.js npm package)
- Node.js applications and CLI tools that depend on tmp directly or transitively
- Debian LTS packages distributing the affected node-tmp library
Discovery Timeline
- 2025-08-07 - CVE-2025-54798 published to NVD
- 2025-11-03 - Last updated in NVD database
Technical Details for CVE-2025-54798
Vulnerability Analysis
The tmp library generates temporary files and directories under a configurable base path. When a caller passes a dir option, the library resolves the path and creates resources within it. In versions 0.2.3 and earlier, the library does not adequately verify whether the resolved dir is a symbolic link pointing outside the intended temporary root. An attacker who can influence the dir value, or who can plant a symbolic link in a predictable location, redirects file creation to an arbitrary filesystem location.
The issue is classified as CWE-59: Improper Link Resolution Before File Access (Link Following). Impact is limited to integrity (file write), not confidentiality or availability, which aligns with the medium severity rating.
Root Cause
The root cause is missing validation that the dir parameter, after resolution, points to a location within the expected temporary directory tree. The library trusts the caller-supplied path and follows symbolic links during creation. The fix in commit 188b25e introduces stricter path handling to reject symlinked dir values that escape the intended root.
Attack Vector
Exploitation requires an attacker to control either the dir argument passed to tmp APIs or to pre-place a symlink at a path the application will use as its temporary directory. In multi-tenant build systems, CI runners, or applications that accept user-influenced paths, this becomes practical. Successful exploitation results in file or directory creation outside the temporary tree, which can overwrite configuration files, drop payloads into watched directories, or interfere with application logic.
No public proof-of-concept exploit and no CISA KEV listing have been recorded for this CVE. See the GitHub Security Advisory GHSA-52f5-9888-hmc6 and the GitHub issue discussion for the upstream technical write-up.
Detection Methods for CVE-2025-54798
Indicators of Compromise
- Unexpected file or directory creation outside standard temporary paths such as /tmp, /var/tmp, or the OS-specific temp root by Node.js processes.
- Symbolic links present inside temporary directories that resolve to sensitive locations like /etc, application config directories, or user home paths.
- Modifications to configuration files immediately preceded by Node.js temporary file activity in audit logs.
Detection Strategies
- Inventory package-lock.json and yarn.lock files across repositories and build agents to flag tmp versions at or below 0.2.3.
- Run npm audit or osv-scanner against project manifests to surface advisory GHSA-52f5-9888-hmc6.
- Monitor filesystem telemetry for Node.js processes performing open, mkdir, or symlink syscalls that resolve outside the configured temp directory.
Monitoring Recommendations
- Enable filesystem auditing (auditd on Linux, Filesystem events on macOS) for write operations targeting paths outside the user's temp directory by Node.js executables.
- Track Software Composition Analysis (SCA) alerts in CI/CD pipelines and fail builds that include vulnerable tmp versions.
- Correlate process ancestry with file integrity monitoring to detect tampering of configuration files following temporary file activity.
How to Mitigate CVE-2025-54798
Immediate Actions Required
- Upgrade tmp to version 0.2.4 or later in all direct and transitive dependencies.
- Rebuild and redeploy Node.js applications and container images that include the patched tmp release.
- Review code that passes a user-controllable dir parameter to tmp APIs and reject paths that are symbolic links or resolve outside an allowlist.
Patch Information
The fix is delivered in tmp version 0.2.4 via upstream commit 188b25e529496e37adaf1a1d9dccb40019a08b1b. Debian users should apply the update referenced in the Debian LTS Announcement. Refer to the GitHub Security Advisory GHSA-52f5-9888-hmc6 for the full advisory text.
Workarounds
- Avoid passing untrusted input to the dir option of tmp functions; hardcode a known-safe temporary root.
- Validate that any caller-supplied dir is a real directory using fs.lstat and reject entries where isSymbolicLink() returns true before invoking tmp.
- Run Node.js services under least-privilege accounts that cannot write to sensitive system or application configuration paths.
# Configuration example: upgrade the tmp package and pin in package.json
npm install tmp@^0.2.4 --save
npm ls tmp # verify no nested versions <= 0.2.3 remain
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
