CVE-2026-101894
@xhmikosr/decompress: Path traversal via symlink chain
When extracting an untrusted archive with the default decompress(input, output) API, a crafted archive containing a chain of symlink entries can make a later entry resolve outside the output directory. The lexical containment checks pass, but the kernel follows the planted symlinks to a path outside output, letting an attacker write (and read) files outside the intended extraction directory.
- No known exploitation
- Severity
- Critical, CVSS 9.1 (v3.1)
- EPSS
- 0.81% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- @xhmikosr/decompress (npm) >= 11.0.0, <= 11.1.3, fixed in 11.1.4 · GHSA-hrh2-vp3x-79xf
- @xhmikosr/decompress (npm) <= 10.2.1, fixed in 10.2.2 · GHSA-hrh2-vp3x-79xf
- decompress (npm) <= 4.2.1, no fix yet · GHSA-hrh2-vp3x-79xf