Executive brief
The decompress package for Node.js, which is used to extract files from archives, contains a vulnerability that allows a specially crafted archive to write or read files outside of the intended folder. This could allow an attacker to overwrite sensitive system files or gain unauthorized access to data on the server. Additionally, the tool failed to properly strip dangerous file permissions, potentially allowing an attacker to create files with elevated privileges.
Technical details
The decompress package for Node.js (specifically @xhmikosr/decompress) fails to properly validate archive entries during extraction. The vulnerability stems from three primary issues: hardlink and symlink targets are not checked to ensure they point within the destination directory, path containment logic relied on insecure string prefix comparisons, and the extraction process failed to mask setuid, setgid, and sticky bits from file modes. An attacker can exploit this by providing a malicious archive that uses symlinks or directory traversal sequences to read or write arbitrary files on the host filesystem. The issue is resolved in versions 10.2.1 and 11.1.3 by implementing strict link target validation and proper bitmasking for file permissions.
Affected products
- XhmikosR decompress < 10.2.1, >= 11.0.0 < 11.1.3
Timeline
- 2026-07-14: advisory
- 2026-05-30: patched
References
- https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd
- https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae
- https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89
- https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd
- https://github.com/XhmikosR/decompress/releases/tag/v10.2.1
- https://github.com/XhmikosR/decompress/releases/tag/v11.1.3
- https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9