A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. (CVE-2026-107709)

The vulnerability in Bower decompress-zip (up to version 0.3.3) is caused by insufficient validation of ZIP archive entry paths in the file decompress-zip.js. Specifically, crafted ZIP files containing entries that resolve to directories outside the intended extraction folder can cause files to be written to prefix-sibling directories. This path traversal can be exploited to overwrite arbitrary files, potentially leading to application compromise or remote code execution depending on the target environment and writable sibling directories.

Successful exploitation allows an attacker to overwrite arbitrary files outside the intended extraction directory. This can result in application compromise or remote code execution if the attacker can write to sensitive locations or executable paths. The actual impact depends on the environment and permissions of writable sibling directories.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid extracting untrusted ZIP archives with decompress-zip or implement additional validation to prevent path traversal during extraction.