CVE-2026-53486
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
A vulnerability in the decompress package for Node.js allows creating files and links outside the target directory during archive extraction. The issue stems from missing validation of hardlink and symlink paths, prefix-based path containment checks, and failure to remove setuid, setgid, or sticky bits from file modes.
Risk Assessment
An attacker can use a crafted archive to read or write files outside the target directory, potentially leading to data confidentiality or integrity breaches, or privilege escalation on the system.
Recommendation
Immediately update the @xhmikosr/decompress package to version 10.2.1 or 11.1.3 depending on the branch in use.
Original NVD description (English source)
The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.