What is the CVSS score of CVE-2026-24884?

CVE-2026-24884 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Compressing are affected by CVE-2026-24884?

A critical vulnerability in the Compressing library (CVE-2026-24884) allows attackers to exploit unvalidated symbolic links during TAR archive extraction, potentially enabling unauthorized file…. A patch is available.

Is there a public PoC exploit available for CVE-2026-24884?

Yes, a public proof-of-concept exploit is available for CVE-2026-24884. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-24884?

Within 24 hours: Identify all systems and applications using Compressing library versions 2.0.0, 1.10.3, or earlier through dependency scanning. Within 7 days: Apply vendor patch to upgrade Compressing to patched versions across all environments (development, staging, production). Within 30 days: Conduct security audit of any TAR archives processed during the vulnerability window and validate system integrity.

Compressing CVE-2026-24884

HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-02-04 security-advisories@github.com

GHSA-cc8f-xg8v-72m3

Path Traversal Compressing

8.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 27, 2026 - 20:27 vuln.today

Public exploit code

Patch released

Feb 27, 2026 - 20:27 nvd

Patch available

CVE Published

Feb 04, 2026 - 20:16 nvd

HIGH 8.4

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on compressing (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.0.0.

DescriptionGitHub Advisory

Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor’s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1.

AnalysisAI

Compressing library versions 1.10.3 and prior, and 2.0.0 fail to validate symbolic link targets during TAR archive extraction, allowing attackers to write files to arbitrary locations on the filesystem. Public exploit code exists for this vulnerability, which could enable overwriting critical system files or establishing persistence. Patched versions 1.10.4 and 2.0.1 are available.

Technical ContextAI

Classified as CWE-59 (Improper Link Resolution Before File Access). Affects Compressing. Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor’s handling of existing files, this behavior may allow overwriting sensitive files or cre