CVE-2026-39245
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In the 'decompress' library before version 4.2.2, a path traversal and arbitrary file write vulnerability exists due to improper path containment check. The safeMakeDir function and extraction path validation use String.indexOf() to verify the resolved path is within the output directory, which can be bypassed by missing a path separator boundary. An attacker can write arbitrary files outside the intended directory, bypassing the fix for CVE-2020-12265.
Risk Assessment
The risk for the organization includes the ability to overwrite or create arbitrary files on the system, potentially leading to application compromise, privilege escalation, or permanent data corruption.
Recommendation
Immediately update the 'decompress' library to version 4.2.2 or later, which includes proper path validation with a separator. If an update is not possible, implement additional security checks at the application level.
Other vulnerabilities in decompress
See all- CVE-2026-53486Critical
A vulnerability in the decompress package for Node.js allows creating files and links outside the target directory during archive extraction. The issue stems from missing validation of hardlink and symlink paths, prefix-based path containment checks, and failure to remove setuid, setgid, or sticky bits from file modes.
- CVE-2026-39246High
The 'decompress' library before version 4.2.2 allows arbitrary symlink creation during archive extraction. An attacker can craft an archive with symlink entries pointing to sensitive files outside the extraction directory, leading to information disclosure.
- CVE-2026-39243Medium
The 'decompress' library before version 4.2.2 allows arbitrary hardlink creation during archive extraction. An attacker can craft an archive with a hardlink entry containing an absolute path to any file on the same filesystem, leading to file content disclosure or overwriting.
- CVE-2026-10732Medium
The decompress package in all versions is vulnerable to arbitrary file write via archive extraction (Zip Slip). The vulnerability is due to microtask processing order that bypasses existing protections against writing through symlinks. An attacker can provide a crafted ZIP archive, potentially leading to remote code execution.
Original NVD description (English source)
decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function (index.js line 29) and the extraction path validation (index.js line 106) use String.indexOf() to verify the resolved path is within the output directory: realDestinationDir.indexOf(realOutputPath) !== 0. This check is flawed because it does not enforce a path separator boundary. For example, "/tmp/app_config".indexOf("/tmp/app") returns 0, incorrectly passing the check even though /tmp/app_config is outside /tmp/app. Combined with the unvalidated symlink creation in the same package, an attacker can write arbitrary files to directories adjacent to the extraction target. This is a bypass of the fix for CVE-2020-12265. The correct check requires appending a path separator: realParentPath.indexOf(realOutputPath + path.sep) !== 0.