https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 14:04:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292443 EUVD-2026-292443 https://cve.radiocsirt.org/vuln/euvd-2026-292443 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40931 <p>Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this &#34;Logical vs. Physical&#34; divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5.</p> <p>Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this &#34;Logical vs. Physical&#34; divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40931 https://cve.radiocsirt.org/vuln/ghsa-4c3q-x735-j3r5 <p><strong>Affected:</strong> npm: compressing</p> <p>**1. Executive Summary** This report documents a critical security research finding in the `compressing` npm package (specifically tested on the latest **v2.1.0**). The core vulnerability is a **Partial Fix Bypass** of **CVE-2026-24884**.</p> <p>The current patch relies on a purely logical string validation within the `isPathWithinParent` utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the **actual filesystem state**. By exploiting this &#34;Logical vs. Physical&#34; divergence, we successfully bypassed the security check using a Directory Poisoning technique (pre-existing symbolic links).</p> <p>**Key Findings:**</p> <p>* **Vulnerable Component:** `lib/utils.js` -&gt; `isPathWithinParent()` * **Flaw Type:** Incomplete validation (lack of recursive `lstat` checks). * **Primary Attack Vector:** **Supply Chain via Git Clone** The attack requires zero victim interaction beyond standard developer workflow (`git clone` + `node app.js`). Git natively preserves symlinks during clone, automatically deploying the malicious symlink to victim&#39;s machine without any additional attacker access. * **Result:** Successfully achieved arbitrary file writes outside the intended extraction root on the latest library version.</p> <p>**2. Deep-Dive: Technical Root Cause Analysis** The vulnerability exists because of a fundamental disconnect between how the library **validates** a path and how the Operating System **executes** a write to that path.</p> <p>* **1.…</p> <p><strong>Affected:</strong> npm: compressing</p> <p>**1. Executive Summary** This report documents a critical security research finding in the `compressing` npm package (specifically tested on the latest **v2.1.0**). The core vulnerability is a **Partial Fix Bypass** of **CVE-2026-24884**.</p> <p>The current patch relies on a purely logical string validation within the `isPathWithinParent` utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the **actual filesystem state**. By exploiting this &#34;Logical vs. Physical&#34; divergence, we successfully bypassed the security check using a Directory Poisoning technique (pre-existing symbolic links).</p> <p>**Key Findings:**</p> <p>* **Vulnerable Component:** `lib/utils.js` -&gt; `isPathWithinParent()` * **Flaw Type:** Incomplete validation (lack of recursive `lstat` checks). * **Primary Attack Vector:** **Supply Chain via Git Clone** The attack requires zero victim interaction beyond standard developer workflow (`git clone` + `node app.js`). Git natively preserves symlinks during clone, automatically deploying the malicious symlink to victim&#39;s machine without any additional attacker access. * **Result:** Successfully achieved arbitrary file writes outside the intended extraction root on the latest library version.</p> <p>**2. Deep-Dive: Technical Root Cause Analysis** The vulnerability exists because of a fundamental disconnect between how the library **validates** a path and how the Operating System **executes** a write to that path.</p> <p>* **1.…</p> https://cve.radiocsirt.org/vuln/ghsa-4c3q-x735-j3r5