{
  "schemaVersion": 1,
  "site": "https://cveboard.org",
  "generatedAt": "2026-10-23T20:16:52.489Z",
  "lastRun": "2026-10-23T20:01:03.754Z",
  "liveDays": 14,
  "filters": {
    "kind": null,
    "exploited": false,
    "severity": null,
    "ecosystems": [],
    "tag": "xhmikosr"
  },
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incidents": [
    {
      "id": "cve-2026-101894",
      "url": "https://cveboard.org/i/cve-2026-101894",
      "urlPt": "https://cveboard.org/pt/i/cve-2026-101894",
      "json": "https://cveboard.org/i/cve-2026-101894.json",
      "kind": "vuln",
      "live": false,
      "knownExploited": false,
      "severity": "critical",
      "title": "@xhmikosr/decompress: Path traversal via symlink chain",
      "summary": "When extracting an untrusted archive with the default decompress(input, output) API, a crafted archive containing a chain of symlink entries can make a later entry resolve outside the output directory. The lexical containment checks pass, but the kernel follows the planted symlinks to a path outside output, letting an attacker write (and read) files outside the intended extraction directory.",
      "titlePt": "@xhmikosr/decompress: path traversal via cadeia de links simbólicos",
      "summaryPt": "Ao extrair um arquivo compactado não confiável com a API decompress(input, output) padrão, um arquivo compactado criado pode conter uma cadeia de entradas de link simbólico que faz com que uma entrada posterior seja resolvida fora do diretório de saída. As verificações de contenção lexical passam, mas o kernel segue os links simbólicos plantados para um caminho fora de output, permitindo que um atacante escreva (e leia) arquivos fora do diretório de extração pretendido.",
      "affected": [],
      "omitted": 0,
      "references": [],
      "cwes": [
        {
          "id": "CWE-22",
          "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
        },
        {
          "id": "CWE-59",
          "name": "Improper Link Resolution Before File Access ('Link Following')"
        }
      ],
      "ssvc": {
        "exploitation": "none",
        "automatable": "yes",
        "impact": "total",
        "at": "2026-09-28T17:38:56.943Z"
      },
      "fix": "listed",
      "tags": [
        "xhmikosr",
        "npm"
      ],
      "cves": [
        "CVE-2026-101894"
      ],
      "ghsa": "GHSA-hrh2-vp3x-79xf",
      "cvss": {
        "score": 9.1,
        "version": "3.1",
        "by": "GitHub"
      },
      "epss": {
        "percentage": 0.00814,
        "percentile": 0.5661,
        "asOf": "2026-10-23",
        "by": "FIRST"
      },
      "packages": [
        {
          "ecosystem": "npm",
          "name": "@xhmikosr/decompress",
          "vulnerable": ">= 11.0.0, <= 11.1.3",
          "fixed": "11.1.4",
          "advisory": "GHSA-hrh2-vp3x-79xf"
        },
        {
          "ecosystem": "npm",
          "name": "@xhmikosr/decompress",
          "vulnerable": "<= 10.2.1",
          "fixed": "10.2.2",
          "advisory": "GHSA-hrh2-vp3x-79xf"
        },
        {
          "ecosystem": "npm",
          "name": "decompress",
          "vulnerable": "<= 4.2.1",
          "fixed": null,
          "advisory": "GHSA-hrh2-vp3x-79xf"
        }
      ],
      "vendor": "XhmikosR",
      "product": "decompress",
      "kev": null,
      "breach": null,
      "retracted": false,
      "sources": [
        {
          "label": "GitHub Advisory Database",
          "url": "https://github.com/advisories/GHSA-hrh2-vp3x-79xf"
        }
      ],
      "cvePending": true,
      "publishedAt": "2026-09-29T23:49:42.000Z",
      "updatedAt": "2026-09-29T23:49:42.000Z"
    }
  ],
  "tag": {
    "tag": "xhmikosr",
    "name": "XhmikosR",
    "kev": null
  }
}