2vulnerabilities
- Critical2 (100.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
xhmikosr-decompress
Ecosystem: npm
Downloads:
- 2CriticalAffects 4 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 1
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting xhmikosr-decompress, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-hrh2-vp3x-79xf | Critical | @xhmikosr/decompress: Path traversal via symlink chain### Impact When extracting an untrusted archive with the default `decompress(input, output)` API, a crafted archive containing a chain of symlink entries can make a later entry resolve **outside** the output directory. The lexical containment checks pass, but the kernel follows the planted symlinks to a path outside `output`, letting an attacker write (and read) files outside the intended extraction directory. Overwriting startup scripts or configuration can lead to remote code execution. This is a bypass of the hardening in GHSA-mp2f-45pm-3cg9. Any application that extracts attacker-control |
| GitHub (opens in a new tab) | |
| GHSA-mp2f-45pm-3cg9 | Critical | Decompress: Archive extraction can create files and links outside of the target directory### Impact When extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes the parsed entries, so it affects every format decompress handles: tar, tar.gz, tar.bz2, and zip by default, plus any others added through the plugins option. A link (hardlink) or symlink entry is created without checking where its target points. A hardlink can be aimed at any file the running process can read; that file then appears inside the output directory and its contents are exposed. A symlink can point outside the output directory |
| GitHub (opens in a new tab) |
- GHSA-hrh2-vp3x-79xfCritical@xhmikosr/decompress: Path traversal via symlink chain
>= 11.0.0, < 11.1.4< 10.2.2
### Impact When extracting an untrusted archive with the default `decompress(input, output)` API, a crafted archive containing a chain of symlink entries can make a later entry resolve **outside** the output directory. The lexical containment checks pass, but the kernel follows the planted symlinks to a path outside `output`, letting an attacker write (and read) files outside the intended extraction directory. Overwriting startup scripts or configuration can lead to remote code execution. This is a bypass of the hardening in GHSA-mp2f-45pm-3cg9. Any application that extracts attacker-control
CVE: CVE-2026-101894
- GHSA-mp2f-45pm-3cg9CriticalDecompress: Archive extraction can create files and links outside of the target directory
< 10.2.1>= 11.0.0, < 11.1.3
### Impact When extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes the parsed entries, so it affects every format decompress handles: tar, tar.gz, tar.bz2, and zip by default, plus any others added through the plugins option. A link (hardlink) or symlink entry is created without checking where its target points. A hardlink can be aimed at any file the running process can read; that file then appears inside the output directory and its contents are exposed. A symlink can point outside the output directory
CVE: CVE-2026-53486