{"id":"GHSA-mp2f-45pm-3cg9","revision":null,"records":[{"revision":"1c7b75d70d2a4780aee95a71aee631f4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-53486","aliases":[],"title":"decompress: Archive extraction can create files and links outside the target directory","description":"The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.","state":0,"publishedAt":"2026-07-14T20:07:14.19+00:00","modifiedAt":"2026-07-15T13:26:56.864+00:00","affected":[{"ecosystem":"Vendor product","name":"decompress","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"XhmikosR\",\n                    \"product\": \"decompress\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 10.2.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 11.0.0, < 11.1.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9","https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd","https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae","https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89","https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd","https://github.com/XhmikosR/decompress/releases/tag/v10.2.1","https://github.com/XhmikosR/decompress/releases/tag/v11.1.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53486","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-53486","identifiers":["CVE-2026-53486"]},"retained":false,"historicalAffected":[]},{"revision":"eb8345b28afa4bedb25d77c0786b2eef","observedAt":"2026-10-25T13:17:16.273+00:00","statement":{"source":"nvd","id":"CVE-2026-53486","aliases":[],"title":"The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write fil…","description":"The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.","state":0,"publishedAt":"2026-07-14T21:17:05.447+00:00","modifiedAt":"2026-10-24T21:10:00.13+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd","https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae","https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89","https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd","https://github.com/XhmikosR/decompress/releases/tag/v10.2.1","https://github.com/XhmikosR/decompress/releases/tag/v11.1.3","https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53486","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-22","CWE-59","CWE-732"],"productCriteria":[],"sourceDates":{"published":"2026-07-14T21:17:05.447","lastModified":"2026-10-24T21:10:00.130"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-53486","identifiers":["CVE-2026-53486"]},"retained":false,"historicalAffected":[]},{"revision":"ede9de15623e4824b656ae580385f0b6","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-mp2f-45pm-3cg9","aliases":["CVE-2026-53486"],"title":"Decompress: Archive extraction can create files and links outside of the target directory","description":"### Impact\n\nWhen extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes the parsed entries, so it affects every format decompress handles: tar, tar.gz, tar.bz2, and zip by default, plus any others added through the plugins option.\n\nA link (hardlink) or symlink entry is created without checking where its target points. A hardlink can be aimed at any file the running process can read; that file then appears inside the output directory and its contents are exposed. A symlink can point outside the output directory and redirect a later write.\n\nThe path containment check used a string prefix comparison (`realPath.indexOf(outputPath) !== 0`). Output `/srv/out` does not contain `/srv/out-old`, but the prefix comparison treats it as inside, so an entry can escape into a sibling directory whose name starts with the output directory name.\n\nFile modes were applied as `mode & ~umask`, which does not remove the setuid, setgid, or sticky bits. A crafted entry can create a setuid or setgid file. This matters when extraction runs as root, for example in CI, containers, or install scripts.\n\nAny code that extracts archives from an untrusted or attacker-influenced source is affected. Archives are commonly downloaded before extraction, so this is reachable over the network in many setups.\n\n### Patches\n\nFixed in `@xhmikosr/decompress` 10.2.1 and 11.1.3. Link targets are now resolved and checked against the output directory, containment uses `path.relative`, and setuid, setgid, and sticky bits are removed.\n\nThe upstream `decompress` package is unmaintained, and all versions through its last release (4.2.1) have the same flaws. There is no upstream fix. Migrate to `@xhmikosr/decompress` 11.1.3 or later.\n\n### Workarounds\n\nExtract only archives you trust. Run extraction as a non-root user so the mode issue cannot create a privileged file. After extracting, reject any symlink or hardlink that points outside the target and any file with unexpected mode bits.\n\n### Resources\n\n* Related prior issue in the upstream project this package forks: CVE-2020-12265 / GHSA-qgfr-5hqp-vrw9\n* Fix commits and releases:\n  * https://github.com/XhmikosR/decompress/releases/tag/v10.2.1\n  * https://github.com/XhmikosR/decompress/releases/tag/v11.1.3\n  * https://github.com/XhmikosR/decompress/commit/aca5aac\n  * https://github.com/XhmikosR/decompress/commit/281cefa\n  * https://github.com/XhmikosR/decompress/commit/60b5299","state":0,"publishedAt":"2026-07-06T20:27:38+00:00","modifiedAt":"2026-09-10T03:50:12.3022188+00:00","affected":[{"ecosystem":"npm","name":"@xhmikosr/decompress","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"10.2.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@xhmikosr/decompress","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"11.0.0"},{"kind":"fixed","version":"11.1.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"decompress","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"4.2.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9","https://github.com/XhmikosR/decompress/commit/281cefa","https://github.com/XhmikosR/decompress/commit/60b5299","https://github.com/XhmikosR/decompress/commit/aca5aac","https://github.com/XhmikosR/decompress"],"sourceUrl":"https://github.com/advisories/GHSA-mp2f-45pm-3cg9","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-mp2f-45pm-3cg9","identifiers":["GHSA-mp2f-45pm-3cg9","CVE-2026-53486"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T09:09:26.8428861+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T09:09:26.8428861+00:00","lastSuccessAt":"2026-10-27T09:09:27.2118469+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:27.2119981+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-aabe25475865c7edee522f4302371edf7f08f4ba2936ed86dd9f3eab30c8198d","complete":true,"records":414888,"lastAttemptAt":"2026-10-27T09:09:26.1888005+00:00","lastSuccessAt":"2026-10-27T09:00:39.8201567+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.1888005+00:00","snapshotPublishedAt":"2026-10-27T08:33:34+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T09:09:33.2115253+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T09:09:26.8428861+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T09:09:26.8428861+00:00","lastSuccessAt":"2026-10-27T09:09:30.438867+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:30.4388678+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2f1de7fa5541453e964c3923e20a9f35","complete":true,"records":13416,"lastAttemptAt":"2026-10-27T09:09:31.2124779+00:00","lastSuccessAt":"2026-10-27T09:03:12.991+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:03:12.991+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13477,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-27T09:09:26.6530761+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.6530761+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T09:09:26.4482482+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.4482482+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-27T09:09:26.7642122+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.7642122+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-513066461af8d030bad8efab4fea81eabd246acd525512aa7469c95ccf02c320","complete":true,"records":230813,"lastAttemptAt":"2026-10-27T09:09:26.5496184+00:00","lastSuccessAt":"2026-10-27T09:02:44.9044939+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.5496184+00:00","snapshotPublishedAt":"2026-10-27T08:48:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}