{"metadata": {"vulnerability": "CVE-2026-101894", "count": 22, "kinds": {"milestone": 4, "sighting": 10, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-28T15:55:37.906Z", "date_only": false, "value": "2026-09-28T15:55:37.906Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-101894", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-28T16:57:11.440Z", "date_only": false, "value": "2026-09-28T16:57:11.440Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-101894", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-28T16:57:11.440Z", "date_only": false, "value": "2026-09-28T16:57:11.440Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-101894", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-28T17:17:48Z", "date_only": false, "value": "2026-09-28T17:17:48Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-HRH2-VP3X-79XF", "record": "GHSA-HRH2-VP3X-79XF", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-28T17:17:48.830Z", "date_only": false, "value": "2026-09-28T17:17:48.830", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-101894", "record": "FKIE_CVE-2026-101894", "field": "published"}, {"timestamp": "2026-09-28T17:31:16.271Z", "date_only": false, "value": "2026-09-28T17:31:16.271754Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwltrgbz6p2g", "record": "CVE-2026-101894", "field": "creation_timestamp", "uuid": "72b25472-2cbb-44b2-bfa0-5f268acbcf7b", "content": "\ud83d\udd34 CVE-2026-101894 - Critical (9.1)\n\nThe decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default dec...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-101894/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwltrgbz6p2g"}, {"timestamp": "2026-09-28T17:38:56.943Z", "date_only": false, "value": "2026-09-28T17:38:56.943847Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-101894", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-28T17:38:56.943Z", "date_only": false, "value": "2026-09-28T17:38:56.943847Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-101894", "record": "FKIE_CVE-2026-101894", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-28T17:39:11.304Z", "date_only": false, "value": "2026-09-28T17:39:11.304Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-101894", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-28T17:39:11.304Z", "date_only": false, "value": "2026-09-28T17:39:11.304Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-101894", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-28T18:00:06.169Z", "date_only": false, "value": "2026-09-28T18:00:06.169727Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwlvezkhfx2i", "record": "CVE-2026-101894", "field": "creation_timestamp", "uuid": "7b797351-b4ba-497b-8a6f-188d99cf6350", "content": "CVE-2026-101894 - decompress\nThe decompress library used in Node.js applications may let a specially crafted archive place files outside the intended extraction folder. This could let an attacker modify\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#decompress #xhmikosr #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mwlvezkhfx2i"}, {"timestamp": "2026-09-28T18:09:01.431Z", "date_only": false, "value": "2026-09-28T18:09:01.431713Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwlvuycgos25", "record": "CVE-2026-101894", "field": "creation_timestamp", "uuid": "ef4d7475-e9fc-4363-b2ca-73e963b3e19c", "content": "\ud83d\udea8 CVE-2026-101894 \u2014 CVSS 9.1 CRITICAL\n\nThe decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(in...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-101894\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwlvuycgos25"}, {"timestamp": "2026-09-29T01:00:07Z", "date_only": false, "value": "2026-09-29T01:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103707", "record": "CVE-2026-101894", "field": "creation_timestamp", "uuid": "e0258373-39d1-4309-b701-9764a0366b55", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-101894\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 00:50:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-101894 PoC: @xhmikosr/decompress symlink-chain archive path traversal (bypass CVE-2026-53486). Node lab + lockfile scan + mass evil.tar upload exploit. CVSS 9.1. https://pocbit.org/pocs/cve-2026-101894\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103707"}, {"timestamp": "2026-09-29T01:00:07Z", "date_only": false, "value": "2026-09-29T01:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103707", "record": "CVE-2026-101894", "field": "creation_timestamp", "uuid": "d0b19af9-8e5e-4738-9523-2561fc64501c", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-101894\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 00:50:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-101894 PoC: @xhmikosr/decompress symlink-chain archive path traversal (bypass CVE-2026-53486). Node lab + lockfile scan + mass evil.tar upload exploit. CVSS 9.1. https://pocbit.org/pocs/cve-2026-101894\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103707"}, {"timestamp": "2026-09-29T03:00:11Z", "date_only": false, "value": "2026-09-29T03:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/6_Oeq2CRJE8os8WHnCwXZbDEI0tCi0KqIlGVcCySNndfyQ4", "record": "CVE-2026-101894", "field": "creation_timestamp", "uuid": "d0843b88-6c61-4932-be84-cab2a27b4c14"}, {"timestamp": "2026-09-29T03:00:11Z", "date_only": false, "value": "2026-09-29T03:00:11.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/6_Oeq2CRJE8os8WHnCwXZbDEI0tCi0KqIlGVcCySNndfyQ4", "record": "CVE-2026-101894", "field": "creation_timestamp", "uuid": "a79f1fe8-0897-407c-902a-e3246aea0508"}, {"timestamp": "2026-09-29T09:00:05Z", "date_only": false, "value": "2026-09-29T09:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/xYupCOiSFluxoRtEIIOqRNM-7ebwlq042DjZCiLHA-8Nahg", "record": "CVE-2026-101894", "field": "creation_timestamp", "uuid": "0196435c-f611-4fd6-960b-565cf6a8ce85"}, {"timestamp": "2026-09-29T09:00:05Z", "date_only": false, "value": "2026-09-29T09:00:05.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/xYupCOiSFluxoRtEIIOqRNM-7ebwlq042DjZCiLHA-8Nahg", "record": "CVE-2026-101894", "field": "creation_timestamp", "uuid": "d4e1f84c-900c-4f65-86ee-6974023c3f7a"}, {"timestamp": "2026-09-29T23:49:42Z", "date_only": false, "value": "2026-09-29T23:49:42Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-HRH2-VP3X-79XF", "record": "GHSA-HRH2-VP3X-79XF", "field": "published"}, {"timestamp": "2026-09-29T23:49:42Z", "date_only": false, "value": "2026-09-29T23:49:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-HRH2-VP3X-79XF", "record": "GHSA-HRH2-VP3X-79XF", "field": "modified"}, {"timestamp": "2026-09-30T03:30:30Z", "date_only": false, "value": "2026-09-30T03:30:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/c3b0d10c48acd055c898802fe5191eff", "record": "CVE-2026-101894", "field": "creation_timestamp", "uuid": "e698ac91-98fa-41ad-ab0b-cb3dee8a0bc6", "content": "# CVE-2026-101894: CVE-2026-101894: Arbitrary File Read/Write via Symbolic Link Chaining in @xhmikosr/decompress\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-101894\n\n## Summary\nCVE-2026-101894 is a critical path traversal vulnerability in @xhmikosr/decompress before versions 10.2.2 and 11.1.4, stemming from an incomplete hardening bypass of CVE-2026-53486 where static lexical containment checks fail to detect kernel-level resolution of crafted symlink chains, allowing arbitrary local file modification and execution.\n\n## TL;DR\nA path traversal vulnerability in @xhmikosr/decompress allows attackers to write files outside the target directory via a crafted chain of symlink entries, bypassing lexical containment checks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 9.1\n- **EPSS Score**: 0.00814\n- **Exploit Status**: PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @xhmikosr/decompress\n- decompress\n- **@xhmikosr/decompress**: < 10.2.2 (Fixed in: `10.2.2`)\n- **@xhmikosr/decompress**: < 11.1.4 (Fixed in: `11.1.4`)\n- **decompress**: <= 4.2.1 (Fixed in: `None`)\n\n## Mitigation\n\n- Upgrade @xhmikosr/decompress to fixed versions\n- Replace legacy 'decompress' library with maintained fork\n- Run extraction processes in isolated, non-root sandbox environments\n\n**Remediation Steps:**\n1. Identify vulnerable packages using npm audit\n2. Update package.json dependencies to >=10.2.2 or >=11.1.4\n3. Replace any occurrences of 'decompress' with '@xhmikosr/decompress'\n4. Rebuild lockfiles and deploy patches\n\n## References\n\n- [Official Security Advisory](https://github.com/XhmikosR/decompress/security/advisories/GHSA-hrh2-vp3x-79xf)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-101894)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-101894)\n- [Release Version 10.2.2](https://github.com/XhmikosR/decompress/releases/tag/v10.2.2)\n- [Release Version 11.1.4](https://github.com/XhmikosR/decompress/releases/tag/v11.1.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-101894) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/c3b0d10c48acd055c898802fe5191eff"}, {"timestamp": "2026-09-30T19:38:27.293Z", "date_only": false, "value": "2026-09-30T19:38:27.293", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-101894", "record": "FKIE_CVE-2026-101894", "field": "lastModified"}]}