The decompress package is vulnerable to an arbitrary file write vulnerability via archive extraction (Zip Slip) in all versions. When extracting a specially crafted ZIP archive containing two entries with the same path—first a symlink and then a regular file—the microtask processing order causes the file content to be written through the symlink to an arbitrary target outside the output directory. This bypasses all existing path traversal protections, including the preventWritingThroughSymlink mechanism introduced to fix CVE-2020-12265. An attacker can exploit this to write arbitrary files on the host filesystem, potentially leading to remote code execution.

An attacker can write arbitrary files to locations outside the intended extraction directory by exploiting the symlink and file entry ordering in a crafted ZIP archive. This arbitrary file write can lead to remote code execution if the attacker writes malicious files to sensitive locations. The vulnerability bypasses existing symlink protections, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, avoid extracting untrusted ZIP archives with decompress or use alternative tools that do not exhibit this vulnerability.