{"id":"CVE-2026-53486","aliases":["CLSA-2026-1792231664","EUVD-2026-44465","GHSA-mp2f-45pm-3cg9","RHSA-2026:40415","ROOT-APP-NPM-CVE-2026-53486"],"status":"published","title":"decompress: Archive extraction can create files and links outside the target directory","description":"The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00749,"percentile":0.55381,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-59","CWE-732"],"published":"2026-07-06T20:27:38Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"npm","package":"@xhmikosr/decompress","fixed_in":["10.2.1","11.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@xhmikosr/decompress","fixed_in":["10.2.0-aikido.1","9.0.1-aikido.1","9.0.1-aikido.2","9.0.1-aikido.3","11.1.3-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"decompress","fixed_in":["4.2.1-aikido.1","4.2.1-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/xhmikosr__decompress","fixed_in":["10.2.0-root.io.1","9.0.1-root.io.1","9.0.1-root.io.2","9.0.1-root.io.3","11.1.3-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/decompress","fixed_in":["4.2.1-root.io.1","4.2.1-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@xhmikosr/decompress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@xhmikosr/decompress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.1.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"decompress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.2.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"decompress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.1-tuxcare.0"},{"fixed":"4.2.1-tuxcare.2"}]}],"versions":["4.2.1","4.2.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"@xhmikosr/decompress","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"10.2.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@xhmikosr/decompress","ranges":[{"type":"SEMVER","events":[{"introduced":"11.0.0"},{"fixed":"11.1.3"}]}]},{"source":"osv","ecosystem":"npm","package":"decompress","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"4.2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"aspnetcore-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.28-1.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"aspnetcore-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.28-1.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"aspnetcore-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.28-1.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-apphost-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.28-1.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-hostfxr-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.28-1.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-runtime-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.28-1.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-runtime-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.28-1.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-8.0-source-built-artifacts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-sdk-dbg-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-targeting-pack-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.28-1.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet-templates-8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dotnet8.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.128-1.2.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:npm","package":"@xhmikosr/decompress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.0-aikido.1"},{"fixed":"9.0.1-aikido.1"},{"fixed":"9.0.1-aikido.2"},{"fixed":"9.0.1-aikido.3"},{"fixed":"11.1.3-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"decompress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-aikido.1"},{"fixed":"4.2.1-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/xhmikosr__decompress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.0-root.io.1"},{"fixed":"9.0.1-root.io.1"},{"fixed":"9.0.1-root.io.2"},{"fixed":"9.0.1-root.io.3"},{"fixed":"11.1.3-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/decompress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-root.io.1"},{"fixed":"4.2.1-root.io.2"}]}]}],"products":[{"vendor":"xhmikosr","product":"decompress"}],"references":[{"url":"https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9","tags":["x_refsource_CONFIRM","advisory","web","article"]},{"url":"https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/XhmikosR/decompress/releases/tag/v10.2.1","tags":["x_refsource_MISC","web","article"]},{"url":"https://github.com/XhmikosR/decompress/releases/tag/v11.1.3","tags":["x_refsource_MISC","web","article"]},{"url":"https://github.com/XhmikosR/decompress/commit/281cefa","tags":["web"]},{"url":"https://github.com/XhmikosR/decompress/commit/60b5299","tags":["web"]},{"url":"https://github.com/XhmikosR/decompress/commit/aca5aac","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mp2f-45pm-3cg9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53486.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53486","tags":["advisory"]},{"url":"https://github.com/XhmikosR/decompress","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40415","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53486","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59869","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40415.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53486","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498122","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59869","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2026-53486","title":"decompress: Archive extraction can create files and links outside the target directory","description":"The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.","status":"published","published":"2026-07-14T20:07:14.19Z","modified":"2026-07-15T13:26:56.864Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-22","CWE-59","CWE-732"],"updated_at":"2026-11-02T14:19:59.761005Z"}],"euvd":[{"id":"EUVD-2026-44465","description":"The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.","status":"published","published":"2026-07-14T20:07:14Z","modified":"2026-07-15T13:26:56Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:19:53.226345Z"}],"ghsa":[{"id":"GHSA-mp2f-45pm-3cg9","title":"Decompress: Archive extraction can create files and links outside of the target directory","description":"### Impact\n\nWhen extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes the parsed entries, so it affects every format decompress handles: tar, tar.gz, tar.bz2, and zip by default, plus any others added through the plugins option.\n\nA link (hardlink) or symlink entry is created without checking where its target points. A hardlink can be aimed at any file the running process can read; that file then appears inside the output directory and its contents are exposed. A symlink can point outside the output directory and redirect a later write.\n\nThe path containment check used a string prefix comparison (`realPath.indexOf(outputPath) !== 0`). Output `/srv/out` does not contain `/srv/out-old`, but the prefix comparison treats it as inside, so an entry can escape into a sibling directory whose name starts with the output directory name.\n\nFile modes were applied as `mode \u0026 ~umask`, which does not remove the setuid, setgid, or sticky bits. A crafted entry can create a setuid or setgid file. This matters when extraction runs as root, for example in CI, containers, or install scripts.\n\nAny code that extracts archives from an untrusted or attacker-influenced source is affected. Archives are commonly downloaded before extraction, so this is reachable over the network in many setups.\n\n### Patches\n\nFixed in `@xhmikosr/decompress` 10.2.1 and 11.1.3. Link targets are now resolved and checked against the output directory, containment uses `path.relative`, and setuid, setgid, and sticky bits are removed.\n\nThe upstream `decompress` package is unmaintained, and all versions through its last release (4.2.1) have the same flaws. There is no upstream fix. Migrate to `@xhmikosr/decompress` 11.1.3 or later.\n\n### Workarounds\n\nExtract only archives you trust. Run extraction as a non-root user so the mode issue cannot create a privileged file. After extracting, reject any symlink or hardlink that points outside the target and any file with unexpected mode bits.\n\n### Resources\n\n* Related prior issue in the upstream project this package forks: CVE-2020-12265 / GHSA-qgfr-5hqp-vrw9\n* Fix commits and releases:\n  * https://github.com/XhmikosR/decompress/releases/tag/v10.2.1\n  * https://github.com/XhmikosR/decompress/releases/tag/v11.1.3\n  * https://github.com/XhmikosR/decompress/commit/aca5aac\n  * https://github.com/XhmikosR/decompress/commit/281cefa\n  * https://github.com/XhmikosR/decompress/commit/60b5299","status":"published","published":"2026-07-06T20:27:38Z","modified":"2026-07-06T20:27:39Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-22","CWE-59","CWE-732"],"updated_at":"2026-11-02T14:40:39.314643Z"}],"nvd":[{"id":"CVE-2026-53486","description":"The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.","status":"published","published":"2026-07-14T21:17:05.447Z","modified":"2026-10-24T21:10:00.13Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-22","CWE-59","CWE-732"],"updated_at":"2026-11-02T14:12:29.879716Z"}],"osv":[{"id":"CVE-2026-53486","title":"decompress: Archive extraction can create files and links outside the target directory","description":"The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.","status":"published","published":"2026-07-14T20:07:14.19Z","modified":"2026-11-11T10:47:31.107325513Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-22","CWE-59","CWE-732"],"updated_at":"2026-11-11T03:21:38.364245Z"},{"id":"GHSA-mp2f-45pm-3cg9","title":"Decompress: Archive extraction can create files and links outside of the target directory","description":"### Impact\n\nWhen extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes the parsed entries, so it affects every format decompress handles: tar, tar.gz, tar.bz2, and zip by default, plus any others added through the plugins option.\n\nA link (hardlink) or symlink entry is created without checking where its target points. A hardlink can be aimed at any file the running process can read; that file then appears inside the output directory and its contents are exposed. A symlink can point outside the output directory and redirect a later write.\n\nThe path containment check used a string prefix comparison (`realPath.indexOf(outputPath) !== 0`). Output `/srv/out` does not contain `/srv/out-old`, but the prefix comparison treats it as inside, so an entry can escape into a sibling directory whose name starts with the output directory name.\n\nFile modes were applied as `mode \u0026 ~umask`, which does not remove the setuid, setgid, or sticky bits. A crafted entry can create a setuid or setgid file. This matters when extraction runs as root, for example in CI, containers, or install scripts.\n\nAny code that extracts archives from an untrusted or attacker-influenced source is affected. Archives are commonly downloaded before extraction, so this is reachable over the network in many setups.\n\n### Patches\n\nFixed in `@xhmikosr/decompress` 10.2.1 and 11.1.3. Link targets are now resolved and checked against the output directory, containment uses `path.relative`, and setuid, setgid, and sticky bits are removed.\n\nThe upstream `decompress` package is unmaintained, and all versions through its last release (4.2.1) have the same flaws. There is no upstream fix. Migrate to `@xhmikosr/decompress` 11.1.3 or later.\n\n### Workarounds\n\nExtract only archives you trust. Run extraction as a non-root user so the mode issue cannot create a privileged file. After extracting, reject any symlink or hardlink that points outside the target and any file with unexpected mode bits.\n\n### Resources\n\n* Related prior issue in the upstream project this package forks: CVE-2020-12265 / GHSA-qgfr-5hqp-vrw9\n* Fix commits and releases:\n  * https://github.com/XhmikosR/decompress/releases/tag/v10.2.1\n  * https://github.com/XhmikosR/decompress/releases/tag/v11.1.3\n  * https://github.com/XhmikosR/decompress/commit/aca5aac\n  * https://github.com/XhmikosR/decompress/commit/281cefa\n  * https://github.com/XhmikosR/decompress/commit/60b5299","status":"published","published":"2026-07-06T20:27:38Z","modified":"2026-09-10T03:50:12.302218818Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-22","CWE-59","CWE-732"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"RHSA-2026:40415","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-16T10:10:44Z","modified":"2026-10-20T10:08:49Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"CLSA-2026-1792231664","title":"TuxCare security update for decompress (2 CVEs)","description":"TuxCare rebuilt decompress to address 2 CVEs. Fixed in 4.2.1-tuxcare.2.","status":"published","published":"2026-10-17T10:07:44Z","modified":"2026-10-17T13:09:28.764801374Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"ROOT-APP-NPM-CVE-2026-53486","title":"CVE-2026-53486 in @xhmikosr/decompress - Patched by Root","description":"Root has patched CVE-2026-53486 in the @xhmikosr/decompress package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-12T10:05:08Z","modified":"2026-10-12T11:15:03.468119936Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}