https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:51:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335662 EUVD-2026-335662 https://cve.radiocsirt.org/vuln/euvd-2026-335662 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39243 <p>decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === &#39;link&#39;), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file&#39;s content. Hardlinks are limited to files on the same filesystem and cannot target directories.</p> <p>decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === &#39;link&#39;), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file&#39;s content. Hardlinks are limited to files on the same filesystem and cannot target directories.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-39243 https://cve.radiocsirt.org/vuln/ghsa-jwp9-9v96-94mx <p><strong>Affected:</strong> npm: decompress</p> <p>decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === &#39;link&#39;), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file&#39;s content. Hardlinks are limited to files on the same filesystem and cannot target directories.</p> <p><strong>Affected:</strong> npm: decompress</p> <p>decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === &#39;link&#39;), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file&#39;s content. Hardlinks are limited to files on the same filesystem and cannot target directories.</p> https://cve.radiocsirt.org/vuln/ghsa-jwp9-9v96-94mx https://cve.radiocsirt.org/vuln/rhsa-2026:37577 <p>decompress: Decompress: File disclosure and corruption via arbitrary hardlink creation decompress: decompress: path traversal via indexOf containment bypass allows arbitrary file write (bypass of CVE-2020-12265 fix) socket.io: engine.io: Socket.IO: Denial of Service via invalid binary POST requests js-yaml: js-yaml: Denial of Service via crafted YAML documents</p> <p>decompress: Decompress: File disclosure and corruption via arbitrary hardlink creation decompress: decompress: path traversal via indexOf containment bypass allows arbitrary file write (bypass of CVE-2020-12265 fix) socket.io: engine.io: Socket.IO: Denial of Service via invalid binary POST requests js-yaml: js-yaml: Denial of Service via crafted YAML documents</p> https://cve.radiocsirt.org/vuln/rhsa-2026:37577