Log in Start free

Vulnerability · Published Jul 14, 2026 · Assigned by GitHub_M

CVE-2026-53486decompress: Archive extraction can create files and links outside the target directory

Critical 9.1

In plain English

A critical-severity path traversal in decompress from XhmikosR. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.7%top 44.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@xhmikosr/decompress10.2.1GHSA-mp2f-45pm-3cg9
npm@xhmikosr/decompress11.1.3GHSA-mp2f-45pm-3cg9
npmdecompressno fix listedGHSA-mp2f-45pm-3cg9

Affected products (as reported)

VendorProductVersions
XhmikosR decompress < 10.2.1>= 11.0.0, < 11.1.3

Weakness: CWE-22, CWE-59, CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References