Skip to main content

@xhmikosr/decompress EUVDEUVD-2026-88365

| CVE-2026-101894 CRITICAL
Path Traversal (CWE-22)
2026-09-28 GitHub_M GHSA-hrh2-vp3x-79xf
RCE Path Traversal Node.js npm Decompress
9.1
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
9.1 CRITICAL

Untrusted archive reaches the default API over the network with no auth or interaction; low-complexity crafted symlink chain yields arbitrary read/write (C:H/I:H), availability not the direct impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
POC Analysis Generated
Sep 28, 2026 - 19:24 vuln.today
Patch available
Sep 28, 2026 - 18:01 EUVD
Metadata Corrected
Sep 28, 2026 - 17:40 vuln.today
tag: npm added
Analysis Generated
Sep 28, 2026 - 17:18 vuln.today
CVE Published
Sep 28, 2026 - 16:57 cve.org
CRITICAL 9.1

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 26,677 npm packages depend on decompress (1,215 direct, 25,553 indirect)

Ecosystem-wide dependent count for version 4.2.1.

DescriptionCVE.org

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink entries so that a later entry resolves outside the output directory. This allows files outside output to be read or written, and overwriting startup scripts or configuration can lead to remote code execution. The maintained @xhmikosr/decompress package is fixed in 10.2.2 and 11.1.4, but the separately affected unmaintained decompress package remains unpatched through 4.2.1. This vulnerability results from a bypass of the incomplete hardening for CVE-2026-53486. @xhmikosr/decompress is fixed in versions 10.2.2 and 11.1.4.

Articles & Coverage 2

News 15 New Node.js Vulnerabilities - 2 Critical, 13 High Severity Sep 29, 2026 News Critical Path Traversal in Node.js decompress Package - CVE-2026-101894 Sep 28, 2026

AnalysisAI

Archive extraction in the Node.js decompress package allows a crafted archive containing chained symlink entries to resolve file writes outside the intended output directory, because the default decompress(input, output) API relies on lexical path containment checks that the kernel's symlink resolution can bypass. This affects @xhmikosr/decompress before 10.2.2 and before 11.1.4, and the separately maintained but unmaintained kevva/decompress package through 4.2.1, which remains unpatched. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires that the consuming application call the default decompress(input, output) API (versions of @xhmikosr/decompress before 10.2.2 and 11.1.4, or any version of the unmaintained kevva/decompress through 4.2.1) on an archive whose contents the attacker controls or can influence. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a credible high-priority issue rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade @xhmikosr/decompress to 10.2.2 or 11.1.4 or later (see https://github.com/XhmikosR/decompress/releases/tag/v10.2.2 and https://github.com/XhmikosR/decompress/releases/tag/v11.1.4); these releases add phased extraction ordering plus an assertSymlinkResolvesInside guard that realpaths the longest existing prefix and deletes any symlink whose target escapes the output directory, and the corresponding commits are 5f4b2f64abb31bbaf1fef8975b595fd7df2558d8 and f6c88c668216d6a12c6cecf4fe0b6c70bf77050a. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all applications and repositories that depend on @xhmikosr/decompress versions before 10.2.2 or before 11.1.4, and on kevva/decompress through 4.2.1, and treat any extraction of attacker-influenced archives on non-Windows platforms as untrusted; disable or block archive extraction endpoints and jobs where possible, and if extraction must continue, immediately wrap the decompress API with a pre-extraction symlink rejection and realpath-based containment check or run extraction in a low-privilege sandbox with a read-only or dedicated output filesystem. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

EUVD-2026-88365 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy