Skip to main content

decompress (npm) EUVDEUVD-2026-44465

| CVE-2026-53486 CRITICAL
Path Traversal (CWE-22)
2026-07-06 https://github.com/XhmikosR/decompress GHSA-mp2f-45pm-3cg9
Path Traversal Red Hat Suse
9.1
CVSS 3.1 · Vendor: https://github.com/XhmikosR/decompress
Share

Severity by source

Vendor (https://github.com/XhmikosR/decompress) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
9.1 CRITICAL

Malicious archive reaches the parser over the network with no auth in the CVSS model (AV:N/PR:N/UI:N); hardlink read gives C:H and out-of-tree/setuid write gives I:H, with no direct availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (https://github.com/XhmikosR/decompress).

CVSS VectorVendor: https://github.com/XhmikosR/decompress

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jul 06, 2026 - 21:17 vuln.today
CVE Published
Jul 06, 2026 - 20:27 github-advisory
CRITICAL 9.1

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 27,027 npm packages depend on decompress (1,212 direct, 25,904 indirect)

Ecosystem-wide dependent count for version 4.2.1.

DescriptionCVE.org

Impact

When extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes the parsed entries, so it affects every format decompress handles: tar, tar.gz, tar.bz2, and zip by default, plus any others added through the plugins option.

A link (hardlink) or symlink entry is created without checking where its target points. A hardlink can be aimed at any file the running process can read; that file then appears inside the output directory and its contents are exposed. A symlink can point outside the output directory and redirect a later write.

The path containment check used a string prefix comparison (realPath.indexOf(outputPath) !== 0). Output /srv/out does not contain /srv/out-old, but the prefix comparison treats it as inside, so an entry can escape into a sibling directory whose name starts with the output directory name.

File modes were applied as mode & ~umask, which does not remove the setuid, setgid, or sticky bits. A crafted entry can create a setuid or setgid file. This matters when extraction runs as root, for example in CI, containers, or install scripts.

Any code that extracts archives from an untrusted or attacker-influenced source is affected. Archives are commonly downloaded before extraction, so this is reachable over the network in many setups.

Patches

Fixed in @xhmikosr/decompress 10.2.1 and 11.1.3. Link targets are now resolved and checked against the output directory, containment uses path.relative, and setuid, setgid, and sticky bits are removed.

The upstream decompress package is unmaintained, and all versions through its last release (4.2.1) have the same flaws. There is no upstream fix. Migrate to @xhmikosr/decompress 11.1.3 or later.

Workarounds

Extract only archives you trust. Run extraction as a non-root user so the mode issue cannot create a privileged file. After extracting, reject any symlink or hardlink that points outside the target and any file with unexpected mode bits.

Resources

  • Related prior issue in the upstream project this package forks: CVE-2020-12265 / GHSA-qgfr-5hqp-vrw9
  • Fix commits and releases:
  • https://github.com/XhmikosR/decompress/releases/tag/v10.2.1
  • https://github.com/XhmikosR/decompress/releases/tag/v11.1.3
  • https://github.com/XhmikosR/decompress/commit/aca5aac
  • https://github.com/XhmikosR/decompress/commit/281cefa
  • https://github.com/XhmikosR/decompress/commit/60b5299

AnalysisAI

Arbitrary file read and write via archive extraction in the Node.js @xhmikosr/decompress library (and the unmaintained upstream decompress package) lets a crafted tar, tar.gz, tar.bz2, or zip archive escape the intended output directory. The flaw combines unchecked hardlink/symlink targets, a broken string-prefix containment check that allows escape into sibling directories, and mode application that preserves setuid/setgid/sticky bits - enabling attackers to read sensitive files, overwrite files outside the target, and plant privileged binaries when extraction runs as root. No public exploit identified at time of analysis, but the closely related upstream CVE-2020-12265 demonstrates the exploitability of this class.

Technical ContextAI

The affected component is a JavaScript archive-decompression library commonly used as a direct or transitive npm dependency to unpack tarballs and zip files, dispatching to format plugins (tar, gzip, bzip2, zip). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) in the entry-writing stage: (1) hardlink and symlink entries are materialized without validating where their targets point, so a hardlink can reference any file the process can read and a symlink can redirect a subsequent write outside the tree; (2) the containment guard used realPath.indexOf(outputPath) !== 0, a naive string-prefix test that wrongly accepts /srv/out-old as inside /srv/out, permitting escape into name-prefixed sibling directories; and (3) file modes were applied as mode & ~umask, which fails to strip setuid/setgid/sticky bits, allowing an archive to create SUID/SGID files. CPE data confirms the affected packages are pkg:npm/@xhmikosr_decompress and pkg:npm/decompress.

RemediationAI

Vendor-released patch: upgrade @xhmikosr/decompress to 10.2.1 or 11.1.3 (or later), which resolve link targets and enforce containment with path.relative and strip setuid/setgid/sticky bits (release notes: https://github.com/XhmikosR/decompress/releases/tag/v10.2.1 and https://github.com/XhmikosR/decompress/releases/tag/v11.1.3; fix commits aca5aac, 281cefa, 60b5299). Projects still depending on the unmaintained upstream decompress package (all versions through 4.2.1 are vulnerable and no upstream fix exists) must migrate to @xhmikosr/decompress 11.1.3 or later rather than pinning a patch. Where immediate upgrade is not possible, extract only archives from trusted sources; run extraction as a non-root, low-privilege user so a crafted entry cannot create a privileged setuid/setgid file (trade-off: none significant, but requires adjusting service/user context); and post-process the output to reject any symlink or hardlink whose resolved target falls outside the target directory and any file carrying unexpected mode bits (trade-off: added validation logic and slight extraction overhead). See the advisory at https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9.

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-44465 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy