Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-54798

20
FAUCET Score

CVE-2025-54798 is a medium-severity vulnerability affecting versions 0.2.3 and below of the 'tmp' package for Node.js. It allows for arbitrary temporary file or directory writes due to a symbolic link vulnerability in the 'dir' parameter. The CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates it can be exploited remotely with low complexity, potentially leading to data integrity issues. While there is no known active exploitation, public exploit code, or Metasploit/Nuclei modules, the vulnerability has been addressed in version 0.2.4 and has seen some community discussion.

Impacted Technologies

VendorProductVersion(s)CPE
< 0.2.4CPE matchmatch criteria
cpe:2.3:a:raszi:tmp:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 3.1

2.5LOW

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
1.0
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.33%
Probability of exploitation in next 30 days
EPSS Percentile
25.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0033 is in the 15th percentile among its peer group of 23,723 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (103)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: tmpFixed in: 0.2.4
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/cluster-logging-operator-bundle
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/cluster-logging-rhel9-operator
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/eventrouter-rhel9
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/log-file-metric-exporter-rhel9
redhatvendor investigatingvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/vector-rhel9
redhatvendor investigatingvia redhat_api
Product: Migration Toolkit for VirtualizationFixed in: migration-toolkit-virtualization/mtv-console-plugin-rhel9
redhatvendor investigatingvia redhat_api
Product: Multicluster Engine for KubernetesFixed in: multicluster-engine/console-mce-rhel8
redhatvendor investigatingvia redhat_api
Product: Multicluster Engine for KubernetesFixed in: multicluster-engine/console-mce-rhel9
redhatvendor investigatingvia redhat_api
Product: Multicluster Global HubFixed in: multicluster-globalhub/multicluster-globalhub-grafana-rhel9
redhatvendor investigatingvia redhat_api
Product: Network Observability OperatorFixed in: network-observability/network-observability-console-plugin-compat-rhel9
redhatvendor investigatingvia redhat_api
Product: Network Observability OperatorFixed in: network-observability/network-observability-console-plugin-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/kiali-ossmc-rhel9
redhatvendor investigatingvia redhat_api
Product: Cryostat 4Fixed in: io.cryostat-cryostat
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-kueue-controller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-mlmd-grpc-server-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-api-server-v2-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-driver-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-launcher-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-runtime-generic-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-runtime-generic-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-mm-rest-proxy-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-model-controller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-modelmesh-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-modelmesh-runtime-adapter-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-modelmesh-serving-controller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-model-registry-operator-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-model-registry-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-notebook-controller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-rhel8-operator
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-training-operator-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-trustyai-service-operator-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-trustyai-service-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-console
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift Container Platform 4Fixed in: openshift4/ose-console-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/ocs-client-console-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/odf-console-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Openshift Data Foundation 4Fixed in: odf4/odf-multicluster-console-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Quay 3Fixed in: quay/quay-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift LightspeedFixed in: openshift-lightspeed/lightspeed-console-plugin-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-console-plugin-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-console-plugin-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift ServerlessFixed in: openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/kiali-operator-bundle
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/kiali-rhel9
redhatvendor investigatingvia redhat_api
Product: OpenShift Service Mesh 3Fixed in: openshift-service-mesh/kiali-rhel9-operator
redhatvendor investigatingvia redhat_api
Product: Red Hat Advanced Cluster Management for Kubernetes 2Fixed in: rhacm2/acm-grafana-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Advanced Cluster Management for Kubernetes 2Fixed in: rhacm2/console-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Ansible Automation Platform 2Fixed in: automation-gateway
redhatvendor investigatingvia redhat_api
Product: Red Hat build of Apicurio Registry 2Fixed in: io.apicurio-apicurio-registry
redhatvendor investigatingvia redhat_api
Product: Red Hat Developer HubFixed in: rhdh/rhdh-hub-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Developer HubFixed in: rhdh/rhdh-rhel9-operator
redhatvendor investigatingvia redhat_api
Product: Red Hat Edge Manager previewFixed in: rhem/flightctl-api-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Edge Manager previewFixed in: rhem/flightctl-cli-artifacts-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Edge Manager previewFixed in: rhem/flightctl-periodic-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Edge Manager previewFixed in: rhem/flightctl-ui-ocp-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Edge Manager previewFixed in: rhem/flightctl-ui-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Edge Manager previewFixed in: rhem/flightctl-worker-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: grafana
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: mozjs60
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: gjs
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: grafana
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: polkit
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: org.keycloak-keycloak-parent
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: org.keycloak-keycloak-parent
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-codeflare-operator-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-dashboard-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-dashboard-rhel9
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-data-science-pipelines-argo-argoexec-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-data-science-pipelines-operator-controller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-kf-notebook-controller-rhel8
redhatvendor investigatingvia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-kuberay-operator-controller-rhel8
redhatend of lifevia redhat_api
Product: Node HealthCheck OperatorFixed in: workload-availability/node-remediation-console-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/devspaces-rhel9-operator
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/imagepuller-rhel9
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/pluginregistry-rhel9
redhatend of lifevia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-hub-api-rhel8
redhatend of lifevia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-hub-db-migration-rhel8
redhatend of lifevia redhat_api
Product: OpenShift PipelinesFixed in: openshift-pipelines/pipelines-hub-ui-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces-tech-preview/idea-rhel9
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces-tech-preview/jetbrains-ide-rhel9
redhatend of lifevia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/kibana6-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/traefik-rhel9
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/argocd-extensions-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/argocd-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/argo-rollouts-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/console-plugin-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/dex-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhoai/odh-trustyai-service-rhel9
redhatend of lifevia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhods/odh-dashboard-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift AI (RHOAI)Fixed in: rhods/odh-rhel8-operator
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/gitops-operator-bundle
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/gitops-rhel8
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/gitops-rhel8-operator
redhatend of lifevia redhat_api
Product: Red Hat OpenShift GitOpsFixed in: openshift-gitops-1/must-gather-rhel8
redhatend of lifevia redhat_api
Product: Red Hat Trusted Artifact SignerFixed in: rhtas/rekor-search-ui-rhel9
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/code-rhel9
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/configbump-rhel9
redhatend of lifevia redhat_api
Product: Red Hat OpenShift Dev SpacesFixed in: devspaces/dashboard-rhel9

Vendor Advisories (2)

redhatCVE-2025-54798Low

tmp: tmp Symbolic Link Write Vulnerability

Aug 7, 2025
npmGHSA-52f5-9888-hmc6low

tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter

Aug 6, 2025

References

lists.debian.org / debian-lts-announce/2025/08/msg00007.html
github.com / raszi/node-tmp/commit/188b25e529496e37adaf1a1d9dccb40019a08b1b
Patch
github.com / raszi/node-tmp/issues/207
Issue TrackingPatch
github.com / raszi/node-tmp/security/advisories/GHSA-52f5-9888-hmc6
ExploitVendor Advisory