CVE-2025-54798: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2025-54798 affects tmp, a temporary file and directory creator for node.js, in versions 0.2.3 and below. The vulnerability was discovered on August 6, 2025, and involves an arbitrary temporary file/directory write vulnerability via symbolic link dir parameter. The issue was fixed in version 0.2.4 (GitHub Advisory).

The vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access) with a CVSS v3.1 base score of 2.5 (LOW) with vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. The issue occurs because the resolvePath function does not properly handle symbolic links when resolving paths, allowing bypass of the assertIsRelative check used in _assertAndSanitizeOptions (GitHub Advisory, Snyk).

The vulnerability allows an attacker to cause files or directories to be written to arbitrary locations by supplying a crafted symbolic link that resolves outside the intended temporary directory. This could potentially lead to unexpected behavior and security implications in the affected systems (Snyk, Rapid7).

The recommended mitigation is to upgrade tmp to version 0.2.4 or higher, which includes a fix for this vulnerability. The fix involves proper handling of symbolic link resolution in the _resolvePath function (GitHub Advisory, Snyk).