{
  "schemaVersion": 1,
  "incident": {
    "id": "cve-2026-101894",
    "url": "https://cveboard.org/i/cve-2026-101894",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-101894",
    "json": "https://cveboard.org/i/cve-2026-101894.json",
    "kind": "vuln",
    "live": false,
    "knownExploited": false,
    "severity": "critical",
    "title": "@xhmikosr/decompress: Path traversal via symlink chain",
    "summary": "When extracting an untrusted archive with the default decompress(input, output) API, a crafted archive containing a chain of symlink entries can make a later entry resolve outside the output directory. The lexical containment checks pass, but the kernel follows the planted symlinks to a path outside output, letting an attacker write (and read) files outside the intended extraction directory.",
    "titlePt": "@xhmikosr/decompress: path traversal via cadeia de links simbólicos",
    "summaryPt": "Ao extrair um arquivo compactado não confiável com a API decompress(input, output) padrão, um arquivo compactado criado pode conter uma cadeia de entradas de link simbólico que faz com que uma entrada posterior seja resolvida fora do diretório de saída. As verificações de contenção lexical passam, mas o kernel segue os links simbólicos plantados para um caminho fora de output, permitindo que um atacante escreva (e leia) arquivos fora do diretório de extração pretendido.",
    "cves": [
      "CVE-2026-101894"
    ],
    "ghsa": "GHSA-hrh2-vp3x-79xf",
    "cvss": {
      "score": 9.1,
      "version": "3.1"
    },
    "epss": {
      "percentage": 0.00814,
      "percentile": 0.5653,
      "asOf": "2026-10-23"
    },
    "packages": [
      {
        "ecosystem": "npm",
        "name": "@xhmikosr/decompress",
        "vulnerable": ">= 11.0.0, <= 11.1.3",
        "fixed": "11.1.4",
        "advisory": "GHSA-hrh2-vp3x-79xf"
      },
      {
        "ecosystem": "npm",
        "name": "@xhmikosr/decompress",
        "vulnerable": "<= 10.2.1",
        "fixed": "10.2.2",
        "advisory": "GHSA-hrh2-vp3x-79xf"
      },
      {
        "ecosystem": "npm",
        "name": "decompress",
        "vulnerable": "<= 4.2.1",
        "fixed": null,
        "advisory": "GHSA-hrh2-vp3x-79xf"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-hrh2-vp3x-79xf"
      }
    ],
    "publishedAt": "2026-09-29T23:49:42.000Z",
    "updatedAt": "2026-09-29T23:49:42.000Z"
  },
  "live": false,
  "events": [
    {
      "id": "ghsa:GHSA-hrh2-vp3x-79xf:ghsa_published:2026-09-29T23:49:42.000Z",
      "incidentId": "cve-2026-101894",
      "type": "ghsa_published",
      "at": "2026-09-29T23:49:42.000Z",
      "detail": {
        "ghsa": "GHSA-hrh2-vp3x-79xf",
        "severity": "critical",
        "fixed": "11.1.4, 10.2.2"
      }
    }
  ]
}