Is CVE-2026-39243 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39243 being exploited in the wild.

How severe is CVE-2026-39243?

Medium severity, with a CVSS score of 5.5, published 9 July 2026.

Which products and versions are affected?

Kevin Mårtensson Decompress before 4.2.2; decompress (npm) SEMVER:introduced=0,last_affected=4.2.1.

Is there a fix for CVE-2026-39243?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-39243 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-39243?

Check whether you run Kevin Mårtensson Decompress or decompress (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39243: kevva decompress arbitrary hardlink creation in archive extraction

CVE-2026-39243 · Severity: medium · CVSS 5.5 · Published 2026-07-09

The decompress package is a popular Node.js library for extracting compressed archives. When extracting a crafted malicious archive, an attacker can create hardlinks to arbitrary files on the same filesystem, allowing them to read sensitive files (secrets, configuration, private keys) or corrupt them through modification. This vulnerability affects applications that extract untrusted archives.

Technologies: Kevin Mårtensson Decompress, decompress (npm). Vendors: Kevin Mårtensson, npm.

Quick answers

Is CVE-2026-39243 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39243 being exploited in the wild.
How severe is CVE-2026-39243?: Medium severity, with a CVSS score of 5.5, published 9 July 2026.
Which products and versions are affected?: Kevin Mårtensson Decompress before 4.2.2; decompress (npm) SEMVER:introduced=0,last_affected=4.2.1.
Is there a fix for CVE-2026-39243?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-39243 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-39243?: Check whether you run Kevin Mårtensson Decompress or decompress (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal / improper link resolution flaw in the decompress library's archive extraction logic. When processing hardlink entries (type === 'link'), the x.linkname field is passed directly to fs.link() without validating that the target is within the intended extraction directory (index.js line 113). An attacker can craft a tar/archive with a link entry whose linkname is an absolute path (e.g., '/tmp/secret.txt' or '/etc/passwd'). The fs.link() call then creates a hardlink inside the extraction directory pointing to the target file, sharing the same inode. This allows the attacker to read the target file's contents by reading the hardlink, or corrupt the original file by writing to the hardlink. Hardlinks are constrained to the same filesystem and cannot target directories. The attack requires an application to extract an untrusted archive and requires user interaction (triggering the extraction), but no authentication. A fix should validate and resolve the link target to ensure it stays within the extraction directory boundary.

Affected products

kevva decompress <= 4.2.1

Identifiers

CVE-2026-39243
GHSA-jwp9-9v96-94mx

Timeline

2026-07-04: disclosed
2026-07-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.