Skip to content
OpenAdvisories

Vendor

kevva

1 known vulnerabilities.

Products

decompress 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.1
    CVE-2026-101894 Public exploit

    @xhmikosr/decompress: Path traversal via symlink chain

    The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a cra…

    XhmikosR kevva decompress decompress npm