Skip to content
OpenAdvisories

Package · npm

decompress

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-101894 Public exploit

    @xhmikosr/decompress: Path traversal via symlink chain

    The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a cra…

    XhmikosR kevva decompress decompress npm