CVE-2026-107709: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Bower Decompress-Zip decompress-zip

The vulnerability in Bower decompress-zip (<=0.3.3) arises from insufficient validation of ZIP archive entry paths in lib/decompress-zip.js. Specifically, crafted ZIP archives containing entries that resolve to directories outside the intended extraction folder can cause files to be written to prefix-sibling directories. This path traversal (CWE-22) can be exploited to overwrite arbitrary files, which may lead to application compromise or remote code execution depending on the target environment's writable paths.

Successful exploitation allows an attacker to overwrite arbitrary files outside the intended extraction directory. This can result in application compromise or remote code execution if critical files are overwritten and the environment permits execution of malicious code. The impact depends on the writable sibling directories accessible during extraction.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid extracting untrusted ZIP archives with decompress-zip versions up to 0.3.3 or implement manual path validation to prevent traversal outside the intended directory.