CVE-2026-39246
Description
A flaw was found in the decompress package for Node.js. The package creates symlinks from archive entries during extraction without validating the link target against the output directory, because the existing containment check only applies to regular file entries. An attacker who can supply a crafted archive for extraction can create a symlink pointing outside the output directory (for example to /etc/passwd), leading to disclosure of arbitrary files readable by the extracting process when the application later reads the extracted content.
Statement
The decompress npm package (all releases through 4.2.1, the last upstream release) is vulnerable to arbitrary symlink creation during archive extraction. When processing a symlink-type entry, decompress passes the entry's link target (x.linkname) directly to fs.symlink() without validating it against the extraction output directory; the existing preventWritingThroughSymlink containment check added for CVE-2020-12265 only applies to regular file entries, not symlink entries. An attacker who can supply a crafted archive for extraction (for example a malicious package tarball or user-uploaded archive) can create a symlink inside the output directory that points to an arbitrary path such as /etc/passwd. If the extracting application subsequently reads or serves the extracted files, the attacker can achieve disclosure of any file readable by the extracting process, and in combination with a later write to the same symlinked path, potentially write through the link as well. The upstream decompress package is unmaintained and no fix has been released; the maintained fork @xhmikosr/decompress resolves this in 10.2.1 and 11.1.3 by validating link targets against the output directory before creating them.
Mitigation
Do not use decompress to extract archives from untrusted sources. Where extraction of externally-supplied or otherwise untrusted archives is required, migrate to the maintained fork @xhmikosr/decompress (>= 10.2.1 or >= 11.1.3), which validates symlink and hardlink targets against the output directory before creating them. As an interim mitigation, run extraction as a non-privileged, sandboxed process and reject any archive containing symlink or hardlink entries before extraction.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat CVSS v3 Score Explanation
Mirrors CISA-ADP CVSSv3.1 assessment (score 7.5); no independent RH scoring rationale to diverge.
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Files or Directories; Modify Files or Directories
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
