decompress npm CVE-2026-39243

Exploitation requires a victim to extract an attacker-controlled archive using the decompress npm package at a version prior to 4.2.2 (UI:R - user or automated process must trigger extraction). The target file must reside on the same physical filesystem as the extraction output directory, since the OS prohibits hardlinks across filesystem boundaries. Only regular files can be targeted; directories are explicitly excluded by the hardlink mechanism. The process executing the extraction must have read access (and, for integrity impact, write access) to the target file - standard user-level permissions are sufficient to read many sensitive files in developer environments. Exploitation is limited by: (1) required extraction trigger (user or pipeline interaction), (2) same-filesystem constraint, (3) inability to target directories. In automated CI/CD or package-installation contexts where untrusted archives are extracted without human review, the user-interaction barrier is effectively removed and exploitation becomes entirely attacker-controlled.

The provided CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N yields a base score of 5.5. A material discrepancy exists between this score and the CVE description: the description explicitly states the vulnerability enables 'overwriting the original file's content', a clear integrity impact that I:N does not reflect. Defenders should treat file-overwrite capability as described but understand it is unconfirmed by the CVSS assignment - verification against GitHub issue #113 or vendor confirmation is recommended. The EPSS score of 0.17% (7th percentile) and the absence of a CISA KEV listing indicate no observed widespread exploitation at time of analysis. The AV:L vector and UI:R requirement (a user must actively extract the archive) substantially constrain opportunistic exploitation in interactive environments. However, in CI/CD pipelines, automated build tools, or package managers that silently extract untrusted archives, the user-interaction barrier is effectively eliminated, raising practical risk closer to an automated attack scenario. The low EPSS score does not necessarily reflect low interest: path-traversal and link-following flaws in archive libraries (e.g., Zip Slip class) have historically attracted exploit development once a POC is published.

An attacker distributes a malicious archive (in any format supported by decompress) containing a hardlink entry whose linkname is set to an absolute path such as /home/user/.ssh/authorized_keys or /etc/shadow. When a developer or automated build pipeline extracts the archive using an unpatched version of decompress, the library calls fs.link('/home/user/.ssh/authorized_keys', '<dest>/<filename>') without validation, creating a hardlink inside the extraction directory that shares an inode with the targeted file. The attacker can then read the file's contents through the exposed hardlink or, if the extraction process has write access to the target, overwrite it to inject an SSH key or corrupt sensitive configuration.