Is CVE-2020-12265 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-12265 being exploited in the wild.

How severe is CVE-2020-12265?

Low severity, with a CVSS score of 3.1, published 3 September 2020.

Which products and versions are affected?

decompress (npm) SEMVER:introduced=0,fixed=4.2.1.

Is there a fix for CVE-2020-12265?

Yes. decompress (npm): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-12265 attacked?

It is attacked over the network.

Am I affected by CVE-2020-12265?

Check whether you run decompress (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-12265: decompress path traversal in archive extraction

CVE-2020-12265 · Severity: low · CVSS 3.1 · Published 2020-09-03

decompress is a Node.js library used to extract compressed archives (tar, zip, etc.). The library fails to properly validate file paths during extraction, allowing attackers to write files outside the intended directory by crafting malicious archives containing path traversal sequences like "../". This can lead to arbitrary file write, potentially compromising system integrity or overwriting critical application files.

Technologies: decompress (npm). Vendors: npm.

Quick answers

Is CVE-2020-12265 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-12265 being exploited in the wild.
How severe is CVE-2020-12265?: Low severity, with a CVSS score of 3.1, published 3 September 2020.
Which products and versions are affected?: decompress (npm) SEMVER:introduced=0,fixed=4.2.1.
Is there a fix for CVE-2020-12265?: Yes. decompress (npm): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-12265 attacked?: It is attacked over the network.
Am I affected by CVE-2020-12265?: Check whether you run decompress (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

decompress (npm): upgrade to 4.2.1 or later
```
npm install decompress@4.2.1
```

Technical details

The vulnerability is a classic path traversal / "Zip Slip" flaw (CWE-22, CWE-59) in the archive extraction logic. The root cause is insufficient sanitization of extracted filenames—the library does not strip or validate relative path components (e.g., "../") before writing files to disk. Attack vectors include: (1) tar/tar.gz archives with directory traversal sequences in filenames (direct extraction), and (2) zip archives using symlink chains to bypass yauzl's limited path validation (race condition exploitation during async extraction). An attacker can craft a malicious archive that, when extracted, creates files in arbitrary filesystem locations. The vulnerability was patched in version 4.2.1; affected versions are all prior to 4.2.1.

Affected products

decompress decompress <4.2.1

Identifiers

CVE-2020-12265
GHSA-qgfr-5hqp-vrw9

Timeline

2019-10-04: disclosed: Vulnerability reported as GitHub issue #71 (Zip Slip)
2020: patched: Fixed in version 4.2.1
2020-09-03: advisory: GHSA-qgfr-5hqp-vrw9 published
2020-04-26: other: CVE-2020-12265 published by NVD

References

https://github.com/kevva/decompress/issues/71

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.