Decompress
Monthly
Archive extraction in the Node.js decompress package allows a crafted archive containing chained symlink entries to resolve file writes outside the intended output directory, because the default decompress(input, output) API relies on lexical path containment checks that the kernel's symlink resolution can bypass. This affects @xhmikosr/decompress before 10.2.2 and before 11.1.4, and the separately maintained but unmaintained kevva/decompress package through 4.2.1, which remains unpatched. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, 9.1) indicates unauthenticated remote triggering with high confidentiality and integrity impact; writing outside output can overwrite startup scripts or configuration and escalate to remote code execution, and the flaw is a bypass of the incomplete hardening previously applied for CVE-2026-53486. Exploitation requires the consuming application to extract an attacker-influenced archive on a non-Windows platform (Windows emulates symlinks via hardlinks and does not follow the affected path), and no public exploit code was identified at time of analysis, though the upstream fix ships a regression test that documents the escape technique.
Arbitrary file write in the npm decompress package (all versions) exploits a second-generation Zip Slip bypass that circumvents protections introduced in the CVE-2020-12265 fix. By crafting a ZIP archive where a symlink entry and a same-named regular file share an identical path, an attacker leverages microtask scheduling order to write file contents through the unresolved symlink to arbitrary locations outside the extraction output directory, creating a realistic path to remote code execution. Publicly available exploit code exists per the E:P temporal modifier and a published PoC Gist, elevating real-world concern especially for applications processing untrusted archives in automated pipelines.
The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Archive extraction in the Node.js decompress package allows a crafted archive containing chained symlink entries to resolve file writes outside the intended output directory, because the default decompress(input, output) API relies on lexical path containment checks that the kernel's symlink resolution can bypass. This affects @xhmikosr/decompress before 10.2.2 and before 11.1.4, and the separately maintained but unmaintained kevva/decompress package through 4.2.1, which remains unpatched. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, 9.1) indicates unauthenticated remote triggering with high confidentiality and integrity impact; writing outside output can overwrite startup scripts or configuration and escalate to remote code execution, and the flaw is a bypass of the incomplete hardening previously applied for CVE-2026-53486. Exploitation requires the consuming application to extract an attacker-influenced archive on a non-Windows platform (Windows emulates symlinks via hardlinks and does not follow the affected path), and no public exploit code was identified at time of analysis, though the upstream fix ships a regression test that documents the escape technique.
Arbitrary file write in the npm decompress package (all versions) exploits a second-generation Zip Slip bypass that circumvents protections introduced in the CVE-2020-12265 fix. By crafting a ZIP archive where a symlink entry and a same-named regular file share an identical path, an attacker leverages microtask scheduling order to write file contents through the unresolved symlink to arbitrary locations outside the extraction output directory, creating a realistic path to remote code execution. Publicly available exploit code exists per the E:P temporal modifier and a published PoC Gist, elevating real-world concern especially for applications processing untrusted archives in automated pipelines.
The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.