CVE-2026-53486: XhmikosR decompress path traversal and privilege escalation during extraction

CVE-2026-53486 · Severity: critical · CVSS 9.1 · Published 2026-07-14

The decompress package for Node.js, which is used to extract files from archives, contains a vulnerability that allows a specially crafted archive to write or read files outside of the intended folder. This could allow an attacker to overwrite sensitive system files or gain unauthorized access to data on the server. Additionally, the tool failed to properly strip dangerous file permissions, potentially allowing an attacker to create files with elevated privileges.

Technologies: Kevin Mårtensson Decompress, decompress (npm). Vendors: Kevin Mårtensson, npm.

Quick answers

Is CVE-2026-53486 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53486 being exploited in the wild.
How severe is CVE-2026-53486?
Critical severity, with a CVSS score of 9.1, published 14 July 2026.
Which products and versions are affected?
Kevin Mårtensson Decompress < 10.2.1, >= 11.0.0 < 11.1.3; @xhmikosr/decompress (npm) SEMVER:introduced=0,fixed=10.2.1; decompress (npm) SEMVER:introduced=0,last_affected=4.2.1.
Is there a fix for CVE-2026-53486?
Yes. @xhmikosr/decompress (npm): upgrade to 10.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53486 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53486?
Check whether you run Kevin Mårtensson Decompress, @xhmikosr/decompress (npm) or decompress (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @xhmikosr/decompress (npm): upgrade to 10.2.1 or later
    npm install @xhmikosr/decompress@10.2.1

Technical details

The decompress package for Node.js (specifically @xhmikosr/decompress) fails to properly validate archive entries during extraction. The vulnerability stems from three primary issues: hardlink and symlink targets are not checked to ensure they point within the destination directory, path containment logic relied on insecure string prefix comparisons, and the extraction process failed to mask setuid, setgid, and sticky bits from file modes. An attacker can exploit this by providing a malicious archive that uses symlinks or directory traversal sequences to read or write arbitrary files on the host filesystem. The issue is resolved in versions 10.2.1 and 11.1.3 by implementing strict link target validation and proper bitmasking for file permissions.

Affected products

  • XhmikosR decompress < 10.2.1, >= 11.0.0 < 11.1.3

Identifiers

  • CVE-2026-53486
  • GHSA-mp2f-45pm-3cg9

Timeline

  • 2026-07-14: advisory
  • 2026-05-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.