EUVD-2026-42768
GHSA-jwp9-9v96-94mx
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AV:L and UI:R because victim must locally extract the archive; PR:N as attacker needs no privileges on target; I:H added because description explicitly confirms file overwrite capability, contradicting the provided I:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.
AnalysisAI
Arbitrary hardlink creation in the decompress npm package (before version 4.2.2) enables read disclosure and overwrite of any file accessible on the same filesystem as the extraction directory. When a victim extracts an attacker-crafted archive, the library passes the hardlink target path (x.linkname) directly to Node.js fs.link() without any path sanitization, allowing a hardlink inside the extraction directory to point at any file the process has access to. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a victim to extract an attacker-controlled archive using the decompress npm package at a version prior to 4.2.2 (UI:R - user or automated process must trigger extraction). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N yields a base score of 5.5. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker distributes a malicious archive (in any format supported by decompress) containing a hardlink entry whose linkname is set to an absolute path such as /home/user/.ssh/authorized_keys or /etc/shadow. When a developer or automated build pipeline extracts the archive using an unpatched version of decompress, the library calls fs.link('/home/user/.ssh/authorized_keys', '<dest>/<filename>') without validation, creating a hardlink inside the extraction directory that shares an inode with the targeted file. … |
| Remediation | Upgrade the decompress package to version 4.2.2 or later, which is stated in the CVE description as introducing validation of the x.linkname field to prevent path escape during hardlink creation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today