The decompress package for Node.js prior to versions 10.2.2 and 11.1.4 contains a path traversal vulnerability (CWE-22) due to insufficient checks on symlink chains during archive extraction. An attacker can craft an archive with chained symlink entries that resolve outside the designated output directory, allowing arbitrary file writes or reads outside the intended path. This can lead to overwriting critical files such as startup scripts or configuration files, which may result in remote code execution. The vulnerability affects the maintained @xhmikosr/decompress package before 10.2.2 and between 11.0.0 and before 11.1.4. The unmaintained decompress package remains vulnerable through version 4.2.1. This vulnerability is a bypass of the incomplete mitigation implemented for CVE-2026-53486.

Successful exploitation allows an attacker to write or read files outside the intended extraction directory by exploiting symlink traversal in archive extraction. This can lead to overwriting critical system files such as startup scripts or configuration files, potentially enabling remote code execution. The CVSS score of 9.1 reflects the critical nature of this vulnerability with high confidentiality and integrity impact and no required privileges or user interaction.

The vulnerability is fixed in the maintained @xhmikosr/decompress package in versions 10.2.2 and 11.1.4. Users should upgrade to these versions or later to remediate the issue. The unmaintained decompress package remains unpatched through version 4.2.1; users of this package should migrate to the maintained fork or apply alternative mitigations. No vendor advisory content contradicts these recommendations.