Executive brief
decompress is a Node.js library used to extract compressed archives (tar, zip, etc.). The library fails to properly validate file paths during extraction, allowing attackers to write files outside the intended directory by crafting malicious archives containing path traversal sequences like "../". This can lead to arbitrary file write, potentially compromising system integrity or overwriting critical application files.
Technical details
The vulnerability is a classic path traversal / "Zip Slip" flaw (CWE-22, CWE-59) in the archive extraction logic. The root cause is insufficient sanitization of extracted filenames—the library does not strip or validate relative path components (e.g., "../") before writing files to disk. Attack vectors include: (1) tar/tar.gz archives with directory traversal sequences in filenames (direct extraction), and (2) zip archives using symlink chains to bypass yauzl's limited path validation (race condition exploitation during async extraction). An attacker can craft a malicious archive that, when extracted, creates files in arbitrary filesystem locations. The vulnerability was patched in version 4.2.1; affected versions are all prior to 4.2.1.
Affected products
- decompress decompress <4.2.1
Timeline
- 2019-10-04: disclosed: Vulnerability reported as GitHub issue #71 (Zip Slip)
- 2020: patched: Fixed in version 4.2.1
- 2020-09-03: advisory: GHSA-qgfr-5hqp-vrw9 published
- 2020-04-26: other: CVE-2020-12265 published by NVD