Search
Find a vulnerability
Search criteria
4 vulnerabilities by XhmikosR
CVE-2026-101894 (GCVE-0-2026-101894)
Vulnerability from nvd – Published: 2026-09-28 16:57 – Updated: 2026-09-28 17:39
VLAI
EPSS
VEX
Title
@xhmikosr/decompress: Path traversal via symlink chain
Summary
The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink entries so that a later entry resolves outside the output directory. This allows files outside output to be read or written, and overwriting startup scripts or configuration can lead to remote code execution. The maintained @xhmikosr/decompress package is fixed in 10.2.2 and 11.1.4, but the separately affected unmaintained decompress package remains unpatched through 4.2.1. This vulnerability results from a bypass of the incomplete hardening for CVE-2026-53486. @xhmikosr/decompress is fixed in versions 10.2.2 and 11.1.4.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 17:38 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/XhmikosR/decompress/security/a… | x_refsource_CONFIRM |
| https://github.com/XhmikosR/decompress/commit/5f4… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/commit/f6c… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/releases/t… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/releases/t… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| XhmikosR | decompress |
Affected:
< 10.2.2
Affected: >= 11.0.0, < 11.1.4 |
|
| kevva | decompress |
Affected:
<= 4.2.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101894",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T17:38:56.943847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T17:39:11.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "decompress",
"vendor": "XhmikosR",
"versions": [
{
"status": "affected",
"version": "\u003c 10.2.2"
},
{
"status": "affected",
"version": "\u003e= 11.0.0, \u003c 11.1.4"
}
]
},
{
"product": "decompress",
"vendor": "kevva",
"versions": [
{
"status": "affected",
"version": "\u003c= 4.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink entries so that a later entry resolves outside the output directory. This allows files outside output to be read or written, and overwriting startup scripts or configuration can lead to remote code execution. The maintained @xhmikosr/decompress package is fixed in 10.2.2 and 11.1.4, but the separately affected unmaintained decompress package remains unpatched through 4.2.1. This vulnerability results from a bypass of the incomplete hardening for CVE-2026-53486. @xhmikosr/decompress is fixed in versions 10.2.2 and 11.1.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T16:57:11.440Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-hrh2-vp3x-79xf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-hrh2-vp3x-79xf"
},
{
"name": "https://github.com/XhmikosR/decompress/commit/5f4b2f64abb31bbaf1fef8975b595fd7df2558d8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/commit/5f4b2f64abb31bbaf1fef8975b595fd7df2558d8"
},
{
"name": "https://github.com/XhmikosR/decompress/commit/f6c88c668216d6a12c6cecf4fe0b6c70bf77050a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/commit/f6c88c668216d6a12c6cecf4fe0b6c70bf77050a"
},
{
"name": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.2"
},
{
"name": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.4"
}
],
"source": {
"advisory": "GHSA-hrh2-vp3x-79xf",
"discovery": "UNKNOWN"
},
"title": "@xhmikosr/decompress: Path traversal via symlink chain"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-101894",
"datePublished": "2026-09-28T16:57:11.440Z",
"dateReserved": "2026-09-28T15:55:37.906Z",
"dateUpdated": "2026-09-28T17:39:11.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53486 (GCVE-0-2026-53486)
Vulnerability from nvd – Published: 2026-07-14 20:07 – Updated: 2026-07-15 13:26
VLAI
EPSS
VEX
Title
decompress: Archive extraction can create files and links outside the target directory
Summary
The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 13:24 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/XhmikosR/decompress/security/a… | x_refsource_CONFIRM |
| https://github.com/XhmikosR/decompress/commit/281… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/commit/60b… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/commit/9fc… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/commit/aca… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/releases/t… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| XhmikosR | decompress |
Affected:
< 10.2.1
Affected: >= 11.0.0, < 11.1.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53486",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T13:24:13.932436Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T13:26:56.864Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "decompress",
"vendor": "XhmikosR",
"versions": [
{
"status": "affected",
"version": "\u003c 10.2.1"
},
{
"status": "affected",
"version": "\u003e= 11.0.0, \u003c 11.1.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T20:07:14.190Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9"
},
{
"name": "https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd"
},
{
"name": "https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae"
},
{
"name": "https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89"
},
{
"name": "https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd"
},
{
"name": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.1"
},
{
"name": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.3"
}
],
"source": {
"advisory": "GHSA-mp2f-45pm-3cg9",
"discovery": "UNKNOWN"
},
"title": "decompress: Archive extraction can create files and links outside the target directory"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53486",
"datePublished": "2026-07-14T20:07:14.190Z",
"dateReserved": "2026-06-09T17:05:25.058Z",
"dateUpdated": "2026-07-15T13:26:56.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101894 (GCVE-0-2026-101894)
Vulnerability from cvelistv5 – Published: 2026-09-28 16:57 – Updated: 2026-09-28 17:39
VLAI
EPSS
VEX
Title
@xhmikosr/decompress: Path traversal via symlink chain
Summary
The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink entries so that a later entry resolves outside the output directory. This allows files outside output to be read or written, and overwriting startup scripts or configuration can lead to remote code execution. The maintained @xhmikosr/decompress package is fixed in 10.2.2 and 11.1.4, but the separately affected unmaintained decompress package remains unpatched through 4.2.1. This vulnerability results from a bypass of the incomplete hardening for CVE-2026-53486. @xhmikosr/decompress is fixed in versions 10.2.2 and 11.1.4.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 17:38 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/XhmikosR/decompress/security/a… | x_refsource_CONFIRM |
| https://github.com/XhmikosR/decompress/commit/5f4… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/commit/f6c… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/releases/t… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/releases/t… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| XhmikosR | decompress |
Affected:
< 10.2.2
Affected: >= 11.0.0, < 11.1.4 |
|
| kevva | decompress |
Affected:
<= 4.2.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101894",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T17:38:56.943847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T17:39:11.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "decompress",
"vendor": "XhmikosR",
"versions": [
{
"status": "affected",
"version": "\u003c 10.2.2"
},
{
"status": "affected",
"version": "\u003e= 11.0.0, \u003c 11.1.4"
}
]
},
{
"product": "decompress",
"vendor": "kevva",
"versions": [
{
"status": "affected",
"version": "\u003c= 4.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink entries so that a later entry resolves outside the output directory. This allows files outside output to be read or written, and overwriting startup scripts or configuration can lead to remote code execution. The maintained @xhmikosr/decompress package is fixed in 10.2.2 and 11.1.4, but the separately affected unmaintained decompress package remains unpatched through 4.2.1. This vulnerability results from a bypass of the incomplete hardening for CVE-2026-53486. @xhmikosr/decompress is fixed in versions 10.2.2 and 11.1.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T16:57:11.440Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-hrh2-vp3x-79xf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-hrh2-vp3x-79xf"
},
{
"name": "https://github.com/XhmikosR/decompress/commit/5f4b2f64abb31bbaf1fef8975b595fd7df2558d8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/commit/5f4b2f64abb31bbaf1fef8975b595fd7df2558d8"
},
{
"name": "https://github.com/XhmikosR/decompress/commit/f6c88c668216d6a12c6cecf4fe0b6c70bf77050a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/commit/f6c88c668216d6a12c6cecf4fe0b6c70bf77050a"
},
{
"name": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.2"
},
{
"name": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.4"
}
],
"source": {
"advisory": "GHSA-hrh2-vp3x-79xf",
"discovery": "UNKNOWN"
},
"title": "@xhmikosr/decompress: Path traversal via symlink chain"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-101894",
"datePublished": "2026-09-28T16:57:11.440Z",
"dateReserved": "2026-09-28T15:55:37.906Z",
"dateUpdated": "2026-09-28T17:39:11.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53486 (GCVE-0-2026-53486)
Vulnerability from cvelistv5 – Published: 2026-07-14 20:07 – Updated: 2026-07-15 13:26
VLAI
EPSS
VEX
Title
decompress: Archive extraction can create files and links outside the target directory
Summary
The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 13:24 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/XhmikosR/decompress/security/a… | x_refsource_CONFIRM |
| https://github.com/XhmikosR/decompress/commit/281… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/commit/60b… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/commit/9fc… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/commit/aca… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/releases/t… | x_refsource_MISC |
| https://github.com/XhmikosR/decompress/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| XhmikosR | decompress |
Affected:
< 10.2.1
Affected: >= 11.0.0, < 11.1.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53486",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T13:24:13.932436Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T13:26:56.864Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "decompress",
"vendor": "XhmikosR",
"versions": [
{
"status": "affected",
"version": "\u003c 10.2.1"
},
{
"status": "affected",
"version": "\u003e= 11.0.0, \u003c 11.1.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T20:07:14.190Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9"
},
{
"name": "https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd"
},
{
"name": "https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae"
},
{
"name": "https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89"
},
{
"name": "https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd"
},
{
"name": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.1"
},
{
"name": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.3"
}
],
"source": {
"advisory": "GHSA-mp2f-45pm-3cg9",
"discovery": "UNKNOWN"
},
"title": "decompress: Archive extraction can create files and links outside the target directory"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53486",
"datePublished": "2026-07-14T20:07:14.190Z",
"dateReserved": "2026-06-09T17:05:25.058Z",
"dateUpdated": "2026-07-15T13:26:56.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}