Vulnerability-Lookup

CVE-2026-53486 (GCVE-0-2026-53486)

Vulnerability from cvelistv5 – Published: 2026-07-14 20:07 – Updated: 2026-07-14 20:07

Title

decompress: Archive extraction can create files and links outside the target directory

Summary

The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

GitHub_M

References

7 references

URL	Tags
https://github.com/XhmikosR/decompress/security/a…	x_refsource_CONFIRM
https://github.com/XhmikosR/decompress/commit/281…	x_refsource_MISC
https://github.com/XhmikosR/decompress/commit/60b…	x_refsource_MISC
https://github.com/XhmikosR/decompress/commit/9fc…	x_refsource_MISC
https://github.com/XhmikosR/decompress/commit/aca…	x_refsource_MISC
https://github.com/XhmikosR/decompress/releases/t…	x_refsource_MISC
https://github.com/XhmikosR/decompress/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
XhmikosR	decompress	Affected: < 10.2.1 Affected: >= 11.0.0, < 11.1.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "decompress",
          "vendor": "XhmikosR",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.0.0, \u003c 11.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732: Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T20:07:14.190Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9"
        },
        {
          "name": "https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd"
        },
        {
          "name": "https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae"
        },
        {
          "name": "https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89"
        },
        {
          "name": "https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd"
        },
        {
          "name": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.1"
        },
        {
          "name": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.3"
        }
      ],
      "source": {
        "advisory": "GHSA-mp2f-45pm-3cg9",
        "discovery": "UNKNOWN"
      },
      "title": "decompress: Archive extraction can create files and links outside the target directory"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53486",
    "datePublished": "2026-07-14T20:07:14.190Z",
    "dateReserved": "2026-06-09T17:05:25.058Z",
    "dateUpdated": "2026-07-14T20:07:14.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53486\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-14T21:17:05.447\",\"lastModified\":\"2026-07-14T21:17:05.447\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"XhmikosR\",\"product\":\"decompress\",\"versions\":[{\"version\":\"\u003c 10.2.1\",\"status\":\"affected\"},{\"version\":\"\u003e= 11.0.0, \u003c 11.1.3\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"},{\"lang\":\"en\",\"value\":\"CWE-59\"},{\"lang\":\"en\",\"value\":\"CWE-732\"}]}],\"references\":[{\"url\":\"https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/XhmikosR/decompress/releases/tag/v10.2.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/XhmikosR/decompress/releases/tag/v11.1.3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-15T09:46:13+00:00",
      "cve": "CVE-2026-53486",
      "id": "CVE-2026-53486",
      "initial_release_date": "2026-07-14T20:07:14.190000+00:00",
      "product_status:known_affected": "4",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "decompress: @xhmikosr/decompress: Decompress: Arbitrary file read/write via crafted archive extraction",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53486.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-53486

Vulnerability from fkie_nvd - Published: 2026-07-14 21:17 - Updated: 2026-07-14 21:17

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd
	security-advisories@github.com	https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae
	security-advisories@github.com	https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89
	security-advisories@github.com	https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd
	security-advisories@github.com	https://github.com/XhmikosR/decompress/releases/tag/v10.2.1
	security-advisories@github.com	https://github.com/XhmikosR/decompress/releases/tag/v11.1.3
	security-advisories@github.com	https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "decompress",
          "vendor": "XhmikosR",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.2.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 11.0.0, \u003c 11.1.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3."
    }
  ],
  "id": "CVE-2026-53486",
  "lastModified": "2026-07-14T21:17:05.447",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-07-14T21:17:05.447",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-59"
        },
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-MP2F-45PM-3CG9

Vulnerability from github – Published: 2026-07-06 20:27 – Updated: 2026-07-06 20:27

Summary

Decompress: Archive extraction can create files and links outside of the target directory

Details

Impact

When extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes the parsed entries, so it affects every format decompress handles: tar, tar.gz, tar.bz2, and zip by default, plus any others added through the plugins option.

A link (hardlink) or symlink entry is created without checking where its target points. A hardlink can be aimed at any file the running process can read; that file then appears inside the output directory and its contents are exposed. A symlink can point outside the output directory and redirect a later write.

The path containment check used a string prefix comparison (realPath.indexOf(outputPath) !== 0). Output /srv/out does not contain /srv/out-old, but the prefix comparison treats it as inside, so an entry can escape into a sibling directory whose name starts with the output directory name.

File modes were applied as mode & ~umask, which does not remove the setuid, setgid, or sticky bits. A crafted entry can create a setuid or setgid file. This matters when extraction runs as root, for example in CI, containers, or install scripts.

Any code that extracts archives from an untrusted or attacker-influenced source is affected. Archives are commonly downloaded before extraction, so this is reachable over the network in many setups.

Patches

Fixed in @xhmikosr/decompress 10.2.1 and 11.1.3. Link targets are now resolved and checked against the output directory, containment uses path.relative, and setuid, setgid, and sticky bits are removed.

The upstream decompress package is unmaintained, and all versions through its last release (4.2.1) have the same flaws. There is no upstream fix. Migrate to @xhmikosr/decompress 11.1.3 or later.

Workarounds

Extract only archives you trust. Run extraction as a non-root user so the mode issue cannot create a privileged file. After extracting, reject any symlink or hardlink that points outside the target and any file with unexpected mode bits.

Resources

Related prior issue in the upstream project this package forks: CVE-2020-12265 / GHSA-qgfr-5hqp-vrw9
Fix commits and releases:
https://github.com/XhmikosR/decompress/releases/tag/v10.2.1
https://github.com/XhmikosR/decompress/releases/tag/v11.1.3
https://github.com/XhmikosR/decompress/commit/aca5aac
https://github.com/XhmikosR/decompress/commit/281cefa
https://github.com/XhmikosR/decompress/commit/60b5299

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@xhmikosr/decompress"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@xhmikosr/decompress"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0"
            },
            {
              "fixed": "11.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "decompress"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "4.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53486"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-59",
      "CWE-732"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-06T20:27:38Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nWhen extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes the parsed entries, so it affects every format decompress handles: tar, tar.gz, tar.bz2, and zip by default, plus any others added through the plugins option.\n\nA link (hardlink) or symlink entry is created without checking where its target points. A hardlink can be aimed at any file the running process can read; that file then appears inside the output directory and its contents are exposed. A symlink can point outside the output directory and redirect a later write.\n\nThe path containment check used a string prefix comparison (`realPath.indexOf(outputPath) !== 0`). Output `/srv/out` does not contain `/srv/out-old`, but the prefix comparison treats it as inside, so an entry can escape into a sibling directory whose name starts with the output directory name.\n\nFile modes were applied as `mode \u0026 ~umask`, which does not remove the setuid, setgid, or sticky bits. A crafted entry can create a setuid or setgid file. This matters when extraction runs as root, for example in CI, containers, or install scripts.\n\nAny code that extracts archives from an untrusted or attacker-influenced source is affected. Archives are commonly downloaded before extraction, so this is reachable over the network in many setups.\n\n### Patches\n\nFixed in `@xhmikosr/decompress` 10.2.1 and 11.1.3. Link targets are now resolved and checked against the output directory, containment uses `path.relative`, and setuid, setgid, and sticky bits are removed.\n\nThe upstream `decompress` package is unmaintained, and all versions through its last release (4.2.1) have the same flaws. There is no upstream fix. Migrate to `@xhmikosr/decompress` 11.1.3 or later.\n\n### Workarounds\n\nExtract only archives you trust. Run extraction as a non-root user so the mode issue cannot create a privileged file. After extracting, reject any symlink or hardlink that points outside the target and any file with unexpected mode bits.\n\n### Resources\n\n* Related prior issue in the upstream project this package forks: CVE-2020-12265 / GHSA-qgfr-5hqp-vrw9\n* Fix commits and releases:\n  * https://github.com/XhmikosR/decompress/releases/tag/v10.2.1\n  * https://github.com/XhmikosR/decompress/releases/tag/v11.1.3\n  * https://github.com/XhmikosR/decompress/commit/aca5aac\n  * https://github.com/XhmikosR/decompress/commit/281cefa\n  * https://github.com/XhmikosR/decompress/commit/60b5299",
  "id": "GHSA-mp2f-45pm-3cg9",
  "modified": "2026-07-06T20:27:38Z",
  "published": "2026-07-06T20:27:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/XhmikosR/decompress/commit/281cefa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/XhmikosR/decompress/commit/60b5299"
    },
    {
      "type": "WEB",
      "url": "https://github.com/XhmikosR/decompress/commit/aca5aac"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/XhmikosR/decompress"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Decompress: Archive extraction can create files and links outside of the target directory"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-53486 (GCVE-0-2026-53486)

FKIE_CVE-2026-53486

GHSA-MP2F-45PM-3CG9

Impact

Patches

Workarounds

Resources

Tags

Sightings

Nomenclature