Skip to main content

decompress npm CVE-2026-39243

| EUVDEUVD-2026-42768 MEDIUM
Improper Link Resolution Before File Access (CWE-59)
2026-07-09 mitre GHSA-jwp9-9v96-94mx
Information Disclosure Red Hat N A Suse
5.5
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
vuln.today AI
7.1 HIGH

AV:L and UI:R because victim must locally extract the archive; PR:N as attacker needs no privileges on target; I:H added because description explicitly confirms file overwrite capability, contradicting the provided I:N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.7 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
Analysis Generated
Jul 10, 2026 - 16:34 vuln.today
CVSS changed
Jul 10, 2026 - 16:22 NVD
5.5 (MEDIUM)
CVE Published
Jul 09, 2026 - 00:00 cve.org
UNKNOWN (no severity yet)

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 27,024 npm packages depend on decompress (1,212 direct, 25,901 indirect)

Ecosystem-wide dependent count for version 4.2.1.

DescriptionCVE.org

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.

AnalysisAI

Arbitrary hardlink creation in the decompress npm package (before version 4.2.2) enables read disclosure and overwrite of any file accessible on the same filesystem as the extraction directory. When a victim extracts an attacker-crafted archive, the library passes the hardlink target path (x.linkname) directly to Node.js fs.link() without any path sanitization, allowing a hardlink inside the extraction directory to point at any file the process has access to. No CISA KEV listing exists and EPSS stands at 0.17% (7th percentile), reflecting low observed exploitation; however, the provided CVSS I:N metric conflicts with the description's explicit mention of file-overwrite capability, and in automated CI/CD pipelines the user-interaction barrier is effectively eliminated.

Technical ContextAI

decompress is a widely used Node.js npm package (https://github.com/kevva/decompress, https://www.npmjs.com/package/decompress) that abstracts multi-format archive extraction. The vulnerability is located in index.js at line 113, where hardlink entries - identified by the condition type === 'link' - cause the library to invoke fs.link(x.linkname, dest) with the attacker-controlled x.linkname field read directly from the archive metadata, with no normalization, path traversal check, or allowlist validation applied. CWE-59 (Improper Link Resolution Before File Access - Link Following) covers exactly this class of flaw: a program follows attacker-supplied link targets to reach unintended filesystem resources. Hardlinks, unlike symbolic links, share the same inode as the original file, meaning any read or write against the hardlink in the extraction directory directly operates on the data blocks of the original target file, bypassing any path-based access checks that may exist at the application layer. The OS-level constraint is that hardlinks cannot cross filesystem boundaries and cannot target directories.

RemediationAI

Upgrade the decompress package to version 4.2.2 or later, which is stated in the CVE description as introducing validation of the x.linkname field to prevent path escape during hardlink creation. Apply the update by running npm update decompress or yarn upgrade decompress and confirm the installed version in your package-lock.json or yarn.lock. The npm package page (https://www.npmjs.com/package/decompress) and the upstream repository (https://github.com/kevva/decompress) should be consulted to independently confirm the 4.2.2 release is tagged and published, as this has not been independently verified from the provided reference data. If immediate upgrade is not feasible, a compensating control is to sandbox the extraction process inside a container or chroot with a minimal isolated filesystem, which limits the set of files reachable via hardlink - this adds operational overhead and does not fix the root cause. Alternatively, avoid extracting archives sourced from untrusted parties in processes that have access to sensitive files. Do not rely on output-directory permission restrictions alone, as hardlinks bypass path-based checks.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-59 – Improper Link Resolution Before File Access

View all
CVE-2020-0787 HIGH POC
7.8
CVE-2015-1130 HIGH POC
7.8
CVE-2015-5287 HIGH POC
7.8
CVE-2026-41091 HIGH POC
7.8
CVE-2019-1069 HIGH POC
7.8
CVE-2026-81963 HIGH POC
7.8
CVE-2016-6664 HIGH POC
7.0
CVE-2025-60710 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-39243 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy