Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Decompress npm packages could run malicious code

CVE-2020-12265 · published 4 days ago
Summary

The decompress libraries used to unzip files in JavaScript applications can be tricked into running unwanted code when handling specially crafted archive files. This could let an attacker execute code on your server or compromise data. Update each affected decompress package to the latest released version as soon as possible.

What to do
  • Update sindresorhus decompress to version 4.2.1.
  • Update decompress to version 4.2.1-aikido.2.
  • Update rootio @rootio/decompress to version 4.2.1-root.io.2.
  • Update decompress_project decompress to version 4.2.1 or later.
Affected software
Ecosystem VendorProductAffected versions
npm sindresorhus decompress < 4.2.1
Fix: upgrade to 4.2.1
– decompress_project decompress < 4.2.1
cpe:2.3:a:decompress_project:decompress:*:*:*:*:*:node.js:*:*
Root:npm – decompress < 4.2.1-aikido.2
Fix: upgrade to 4.2.1-aikido.2
Root:npm rootio @rootio/decompress < 4.2.1-root.io.2
Fix: upgrade to 4.2.1-root.io.2
Original advisory text
CVE-2020-12265 in decompress - Patched by Root
Root has patched CVE-2020-12265 in the decompress package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-22Path Traversal
CWE-59Link Following
Timeline
Published6 Oct 2026
Updated7 Oct 2026
First seen6 Mar 2026
Sources
GHSA-qgfr-5hqp-vrw9 · GHSA
CVE-2020-12265 · NVD
CVE-2020-12265 · OSV
ROOT-APP-NPM-CVE-2020-12265 · OSV
Track software like this
Free during beta