CVE-2026-53486

Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in @xhmikosr/decompress

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-53486

Affected Vendors & Products

Vendor	Product	Version / Range
xhmikosr	decompress	to 11.1.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Node.js decompress package. It allows archive extraction to create files and links outside the intended target directory. Crafted archives can exploit this to read or write files outside the directory by manipulating hardlinks, symlinks, or file modes. The issue was fixed in versions 10.2.1 and 11.1.3 of @xhmikosr/decompress.

Detection Guidance

To detect this vulnerability, check if your system uses vulnerable versions of @xhmikosr/decompress (prior to 10.2.1 or 11.1.3). Inspect package.json files for the package and verify installed versions using commands like 'npm list @xhmikosr/decompress' or 'npm ls @xhmikosr/decompress'. If vulnerable versions are found, update immediately to 10.2.1 or 11.1.3.

Impact Analysis

An attacker could use a malicious archive to access or modify sensitive files outside the extraction directory. This could lead to data breaches, unauthorized file changes, or system compromise. The high CVSS score (9.1) indicates severe impact on confidentiality and integrity.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data (e.g., personal or health information). GDPR and HIPAA mandate strict controls over data access and integrity, which this flaw undermines.

Mitigation Strategies

Update the @xhmikosr/decompress package to version 10.2.1 or later if using version 10.x, or to version 11.1.3 or later if using version 11.x. This addresses the issue where hardlink and symlink entries could create files outside the target directory during archive extraction.

Hi! I’m here to help you understand CVE-2026-53486. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70