Executive brief
Compressing is a Node.js library for handling TAR archive extraction. The vulnerability allows attackers to write files to arbitrary locations on the server by embedding malicious symlinks in TAR archives. An attacker supplying a crafted archive can bypass extraction directory restrictions and write or overwrite files in critical locations, potentially leading to code execution, privilege escalation, or system compromise.
Technical details
The vulnerability is a symlink traversal (CWE-59) in the TAR extraction logic. The root cause is that compressing.tar.uncompress sanitizes destination paths of archive entries but fails to validate or restrict the targets of symlinks within TAR archives. During extraction, embedded symlinks are created in the output directory. When subsequent file entries are processed, they resolve through the symlink and are written to the symlink target rather than the intended extraction root. This enables arbitrary file write outside the extraction directory. The attack requires the attacker to supply a crafted TAR archive; no authentication or user interaction is required. Patches are available in versions 2.0.1 and 1.10.4.
Affected products
- node-modules compressing <= 1.10.3 or 2.0.0
Timeline
- 2026-02-03: disclosed
- 2026-02-03: patched: Versions 2.0.1 and 1.10.4 contain fixes