# CVE-2026-53486: XhmikosR decompress path traversal and privilege escalation during extraction

Source: https://junglewise.ai/threats/cve-2026-53486-xhmikosr-decompress-path-traversal-and-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-53486 · Severity: critical · CVSS 9.1 · Published 2026-07-14

The decompress package for Node.js, which is used to extract files from archives, contains a vulnerability that allows a specially crafted archive to write or read files outside of the intended folder. This could allow an attacker to overwrite sensitive system files or gain unauthorized access to data on the server. Additionally, the tool failed to properly strip dangerous file permissions, potentially allowing an attacker to create files with elevated privileges.

Technologies: [Kevin Mårtensson Decompress](https://junglewise.ai/threats/technologies/decompress), [decompress (npm)](https://junglewise.ai/threats/technologies/npm-decompress). Vendors: [Kevin Mårtensson](https://junglewise.ai/threats/vendors/kevin-m-rtensson), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-53486 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53486 being exploited in the wild.

**How severe is CVE-2026-53486?** Critical severity, with a CVSS score of 9.1, published 14 July 2026.

**Which products and versions are affected?** Kevin Mårtensson Decompress < 10.2.1, >= 11.0.0 < 11.1.3; @xhmikosr/decompress (npm) SEMVER:introduced=0,fixed=10.2.1; decompress (npm) SEMVER:introduced=0,last_affected=4.2.1.

**Is there a fix for CVE-2026-53486?** Yes. @xhmikosr/decompress (npm): upgrade to 10.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53486 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53486?** Check whether you run Kevin Mårtensson Decompress, @xhmikosr/decompress (npm) or decompress (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @xhmikosr/decompress (npm): upgrade to 10.2.1 or later

  ```sh
  npm install @xhmikosr/decompress@10.2.1
  ```


## Technical details

The decompress package for Node.js (specifically @xhmikosr/decompress) fails to properly validate archive entries during extraction. The vulnerability stems from three primary issues: hardlink and symlink targets are not checked to ensure they point within the destination directory, path containment logic relied on insecure string prefix comparisons, and the extraction process failed to mask setuid, setgid, and sticky bits from file modes. An attacker can exploit this by providing a malicious archive that uses symlinks or directory traversal sequences to read or write arbitrary files on the host filesystem. The issue is resolved in versions 10.2.1 and 11.1.3 by implementing strict link target validation and proper bitmasking for file permissions.

## Affected products

- XhmikosR decompress < 10.2.1, >= 11.0.0 < 11.1.3

## Identifiers

- CVE-2026-53486
- GHSA-mp2f-45pm-3cg9

## Timeline

- 2026-07-14: advisory
- 2026-05-30: patched

## References

- [https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd](https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd)
- [https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae](https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae)
- [https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89](https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89)
- [https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd](https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd)
- [https://github.com/XhmikosR/decompress/releases/tag/v10.2.1](https://github.com/XhmikosR/decompress/releases/tag/v10.2.1)
- [https://github.com/XhmikosR/decompress/releases/tag/v11.1.3](https://github.com/XhmikosR/decompress/releases/tag/v11.1.3)
- [https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9](https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9)

## Related threats

- [decompress package path traversal via symlink chains](https://junglewise.ai/threats/cve-2026-101894-the-decompress-package-for-node-js-extracts-archives-prior-to-10)
- [kevva decompress arbitrary symlink creation during extraction](https://junglewise.ai/threats/cve-2026-39246-kevva-decompress-arbitrary-symlink-creation-during-extraction)
- [kevva decompress directory traversal in path validation](https://junglewise.ai/threats/cve-2026-39245-kevva-decompress-directory-traversal-in-path-validation)
- [kevva decompress arbitrary hardlink creation in archive extraction](https://junglewise.ai/threats/cve-2026-39243-kevva-decompress-arbitrary-hardlink-creation-in-archive)
- [kevva decompress Arbitrary File Write via Zip Slip bypass](https://junglewise.ai/threats/cve-2026-10732-kevva-decompress-arbitrary-file-write-via-zip-slip-bypass)