2026-01-22 Daily Vulns

NEW:

CVE	vendor-product	description	metric	Referenceurl	title	GithubURL
CVE-2025-55130	nodejs - node	A flaw in Node.js’s Permissions model allows attackers to bypass `–allow-fs-read` and `–allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.	0	Exploitation: noneAutomatable: noTechnical Impact: total	undefined	github
CVE-2025-13465	Lodash - LodashLodash-amd - Lodash-amdlodash-es - lodash-eslodash.unset - lodash.unset	Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23	CVSS4.0: 6.9 - MEDIUM	0	Exploitation: noneAutomatable: yesTechnical Impact: partial	Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions	github