decompress CVE-2026-10732

Exploitation requires that the target application uses the decompress npm package (any version) to extract ZIP archives that are supplied or influenced by an attacker. The UI:R CVSS rating reflects that a user or automated process must actively initiate archive extraction - applications processing untrusted archives in unattended pipelines (CI/CD, file ingestion services, upload handlers) are effectively equivalent to having no user interaction barrier. The AC:H rating reflects the need to construct a precisely crafted two-entry ZIP with a specific structure: a symlink entry followed by a same-named regular file in a controlled sequence. No attacker-side authentication is required (PR:N). Exploitation impact is bounded by the filesystem permissions of the Node.js process running decompress - containerized deployments with strict volume mounts and least-privilege process identity significantly reduce the attacker's reachable write surface. The bypass specifically defeats the preventWritingThroughSymlink protection introduced for CVE-2020-12265; deployments that applied that prior patch and consider themselves protected are not.

The CVSS 3.1 base score of 6.4 encodes AV:N (network-reachable trigger), AC:H (high complexity: requires a precisely crafted two-entry archive), PR:N (no attacker-side authentication), UI:R (a user or process must initiate extraction), and S:U/C:L/I:H/A:L. The I:High rating is the dominant risk signal - arbitrary file write outside the extraction root directly enables RCE in most server deployments. The E:P temporal modifier confirms publicly available proof-of-concept code, lowering the skill bar for exploitation. No EPSS score was included in the provided data, and this CVE is not in the CISA KEV catalog, meaning no confirmed active exploitation at time of analysis. The AC:H and UI:R ratings are meaningful mitigations for interactive deployments, but automated pipelines processing untrusted archives without human review are functionally equivalent to AC:L/UI:N in practice. Critically, operators who applied the CVE-2020-12265 patch believing their deployments were protected remain vulnerable - this CVE explicitly bypasses that prior fix, which is an important risk amplifier beyond raw CVSS.

An attacker delivers a specially crafted ZIP archive to a web application or CI/CD pipeline using decompress for archive processing. The ZIP contains two entries sharing the same relative path: the first is a symlink pointing to a sensitive server-side location such as /etc/cron.d or a web application root, and the second is a regular file containing malicious content such as a cron job or web shell. When the application triggers extraction, the microtask ordering flaw allows the regular file's content to be written through the unresolved symlink to the attacker-chosen target path outside the output directory, achieving arbitrary file plant and likely remote code execution. A proof-of-concept demonstrating this technique is publicly available at https://gist.github.com/Alemmi/409c3cc148c39522c6d6a8538b0e1f9e.