https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T22:18:29.985749+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-33471 cnvd-2020-33471 2026-10-03T22:18:29.991964+00:00 cnvd-2020-33471 https://cve.radiocsirt.org/vuln/euvd-2026-41143 EUVD-2026-41143 2026-10-03T22:18:29.991999+00:00 EUVD-2026-41143 https://cve.radiocsirt.org/vuln/fkie_cve-2020-12265 fkie_cve-2020-12265 2026-10-03T22:18:29.992013+00:00

The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.

 https://cve.radiocsirt.org/vuln/ghsa-qgfr-5hqp-vrw9 GHSA-qgfr-5hqp-vrw9 — Path Traversal in decompress 2026-10-03T22:18:29.992041+00:00

Affected: npm: decompress

Versions of `decompress` prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing`../`.

## Recommendation

Upgrade to version 4.2.1 or later.

 https://cve.radiocsirt.org/vuln/gsd-2020-12265 gsd-2020-12265 2026-10-03T22:18:29.992066+00:00 gsd-2020-12265