decompress (npm) EUVD-2026-44465

Exploitation requires that the target application extracts an attacker-controlled or attacker-influenced archive using vulnerable @xhmikosr/decompress (<10.2.1 or <11.1.3) or any upstream decompress (<=4.2.1); this applies to the default handlers for tar, tar.gz, tar.bz2, and zip, plus any format enabled via the plugins option. The concrete crafted-entry prerequisites are: a hardlink entry (to read arbitrary process-readable files), a symlink entry pointing outside the output directory (to redirect a later write), an output directory that has a name-prefixed sibling such as /srv/out with /srv/out-old present (to abuse the indexOf prefix-check bypass), and - for the SUID/SGID escalation path specifically - extraction performed as root. Limiting factors that reduce real-world risk: the flaw is only reachable if the consuming app unpacks untrusted archives (not a default remote-service listener), the privileged-file impact is neutralized when extraction runs as a non-root user, and the sibling-directory escape needs a directory whose name shares the output path's prefix.

The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact with no privileges or user interaction in the CVSS model. In practice the 'network, no user interaction' rating is optimistic for a library: exploitation depends on the consuming application actually extracting an attacker-influenced archive, so realized attack complexity varies by how the dependency is used - a limiting factor the raw score does not capture. No EPSS score, KEV listing, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; there is no public exploit identified at time of analysis. However, the vendor documents a directly analogous upstream flaw (CVE-2020-12265 / GHSA-qgfr-5hqp-vrw9) with the same escape mechanism, which materially raises real-world plausibility. The setuid/setgid angle sharply escalates impact specifically when extraction runs as root (CI, containers, install scripts), turning a path-traversal write into potential privilege escalation. Net assessment: a genuine high priority for any service that unpacks untrusted archives, moderated by the fact that safe-usage patterns (trusted archives only, non-root extraction) neutralize much of the risk.

An attacker hosts or supplies a malicious archive that a target service downloads and extracts using a vulnerable decompress version. The archive contains a hardlink entry pointing at /etc/shadow (exposing its contents in the output) plus a symlink and a setuid binary entry; when the service extracts as root in a CI runner or container, the attacker reads sensitive files, writes into a sibling directory via the prefix-check bypass, and plants a SUID executable for privilege escalation. No public POC is identified for this specific CVE, but the mechanism mirrors the previously exploited upstream CVE-2020-12265.