EUVD-2026-34785
GHSA-h39j-r5qq-r9mm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (snyk).
CVSS VectorVendor: snyk
Lifecycle Timeline
3Blast Radius
ecosystem impact- 27,024 npm packages depend on decompress (1,212 direct, 25,901 indirect)
Ecosystem-wide dependent count for version 4.2.1.
DescriptionCVE.org
All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same path - the first being a symlink to an arbitrary target and the second being a regular file - the file content is written through the symlink to the target location outside the output directory. This is due to the microtask processing order that checks readlink for the second file before resolving symlink for the first file. An attacker can write arbitrary file on the host filesystem potentially leading to remote code execution by providing a specially crafted ZIP archive. Note: This bypasses all existing path traversal protections including preventWritingThroughSymlink, added as a part of the fix for CVE-2020-12265.
AnalysisAI
Arbitrary file write in the npm decompress package (all versions) exploits a second-generation Zip Slip bypass that circumvents protections introduced in the CVE-2020-12265 fix. By crafting a ZIP archive where a symlink entry and a same-named regular file share an identical path, an attacker leverages microtask scheduling order to write file contents through the unresolved symlink to arbitrary locations outside the extraction output directory, creating a realistic path to remote code execution. Publicly available exploit code exists per the E:P temporal modifier and a published PoC Gist, elevating real-world concern especially for applications processing untrusted archives in automated pipelines.
Technical ContextAI
The decompress npm package (CPE: cpe:2.3:a:n/a:decompress:*:*:*:*:*:*:*:*) provides archive extraction for Node.js. CWE-29 (Path Traversal using '../../filename') describes the root cause class: the extractor fails to confine extracted content to the intended output directory. The specific mechanism is a microtask ordering flaw in the async extraction pipeline - when a ZIP contains a symlink entry and a same-path regular file, the readlink check for the second entry executes before the symlink from the first entry is resolved, bypassing the preventWritingThroughSymlink guard added to address CVE-2020-12265. A secondary code-level flaw exposed in GitHub PR #112 is an indexOf prefix confusion bug: the original guard checked realParentPath.indexOf(realOutputPath) !== 0, which incorrectly passes for sibling paths such as 'dist-evil' when the output path is 'dist' (indexOf returns 0 on any shared string prefix). The fix in PR #112 replaces this with a startsWith(outputPath + path.sep) comparison, which correctly rejects paths that merely share a string prefix with the output directory.
RemediationAI
Monitor GitHub PR #112 (https://github.com/kevva/decompress/pull/112) and the decompress npm registry page for a patched tagged release; upgrade to that version immediately upon publication. The fix replaces flawed indexOf-based containment checks with stricter startsWith(outputPath + path.sep) comparisons, closing both the prefix confusion and the symlink ordering bypass. Do not rely on the preventWritingThroughSymlink configuration option from the CVE-2020-12265 fix - this CVE explicitly circumvents it. Until a patched release is available, consider migrating to a maintained alternative such as adm-zip or unzipper that has independently verified Zip Slip defenses. As a compensating control, validate all archive entry paths before extraction, reject archives containing symlink entries, or run the extraction process inside a container or chroot environment with write access restricted to the intended output directory only - note that process isolation adds deployment complexity and does not fix the underlying library flaw. Restricting the Node.js process to least-privilege filesystem permissions limits the blast radius if exploitation occurs.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-29 – Path Traversal: '\\..\\filename'
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today