Skip to content
OpenAdvisories

Package · npm

decompress

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-101894 Public exploit

    @xhmikosr/decompress: Path traversal via symlink chain

    The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a cra…

    XhmikosR kevva decompress decompress npm
  • Critical 9.1
    CVE-2026-53486

    decompress: Archive extraction can create files and links outside the target directory

    The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that dir…

    XhmikosR decompress decompress @xhmikosr/decompress npm
  • Critical 9.8
    CVE-2020-12265

    Path Traversal in decompress

    The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.

    decompress npm