Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

decompress package can write files outside target folder

CVE-2026-53486 · published 3 months ago
Summary

The Node.js decompress library (versions before 10.2.1 and 11.1.3) can create files or shortcuts outside the folder you tell it to extract to. A specially crafted archive could alter or read files on your system beyond the intended location. Update the library to version 10.2.1 or newer (or 11.1.3 or newer) to stop this behavior.

What to do
  • Update xhmikosr decompress to version 10.2.1.
  • Update xhmikosr decompress to version 11.1.3.
  • Update xhmikosr @xhmikosr/decompress to version 9.0.1-aikido.1.
  • Update decompress to version 4.2.1-aikido.1.
  • Update rootio @rootio/xhmikosr__decompress to version 9.0.1-root.io.1.
  • Update rootio @rootio/decompress to version 4.2.1-root.io.1.
  • Update xhmikosr @xhmikosr/decompress to version 9.0.1-aikido.2.
  • Update rootio @rootio/xhmikosr__decompress to version 9.0.1-root.io.2.
  • Update decompress to version 4.2.1-aikido.2.
  • Update rootio @rootio/decompress to version 4.2.1-root.io.2.
  • Update xhmikosr @xhmikosr/decompress to version 9.0.1-aikido.3.
  • Update rootio @rootio/xhmikosr__decompress to version 9.0.1-root.io.3.
  • Update xhmikosr @xhmikosr/decompress to version 11.1.3-aikido.1.
  • Update rootio @rootio/xhmikosr__decompress to version 11.1.3-root.io.1.
Affected software
Ecosystem VendorProductAffected versions
npm sindresorhus decompress <= 4.2.1
npm xhmikosr decompress < 10.2.1
>= 11.0.0, < 11.1.3
Fix: upgrade to 10.2.1
– xhmikosr decompress < 10.2.1
Root:npm xhmikosr @xhmikosr/decompress < 9.0.1-aikido.1
< 9.0.1-aikido.2
< 9.0.1-aikido.3
< 11.1.3-aikido.1
Fix: upgrade to 9.0.1-aikido.1
Root:npm – decompress < 4.2.1-aikido.1
< 4.2.1-aikido.2
Fix: upgrade to 4.2.1-aikido.1
Root:npm rootio @rootio/xhmikosr__decompress < 9.0.1-root.io.1
< 9.0.1-root.io.2
< 9.0.1-root.io.3
< 11.1.3-root.io.1
Fix: upgrade to 9.0.1-root.io.1
Root:npm rootio @rootio/decompress < 4.2.1-root.io.1
< 4.2.1-root.io.2
Fix: upgrade to 4.2.1-root.io.1
Original advisory text
decompress: Archive extraction can create files and links outside the target directory
The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
CWE-59Link Following
CWE-732Incorrect Permission Assignment for Critical Resource
Timeline
Published14 Jul 2026
Updated4 Nov 2026
First seen6 Jul 2026
Sources
GHSA-mp2f-45pm-3cg9 · GHSA
CVE-2026-53486 · NVD
CVE-2026-53486 · MITRE
ROOT-APP-NPM-CVE-2026-53486 · OSV
CVE-2026-53486 · OSV
Track software like this
Free during beta