CVE-2026-39245 affects decompress versions prior to 4.2.2. The vulnerability arises from an improper path containment check in the safeMakeDir function and extraction path validation in index.js. The check uses realDestinationDir.indexOf(realOutputPath) !== 0, which is flawed because it does not enforce a path separator boundary, allowing directory traversal. For example, a path like "/tmp/app_config" incorrectly passes the check for "/tmp/app". Combined with unvalidated symlink creation, this allows arbitrary file writes outside the intended extraction directory. This vulnerability bypasses the fix implemented for CVE-2020-12265. No official remediation level or patch link is provided in the data.

An attacker can exploit this vulnerability to perform directory traversal and write arbitrary files to directories adjacent to the extraction target. This can lead to unauthorized modification of files, potentially impacting system integrity. The CVSS vector indicates local attack vector with low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade decompress to version 4.2.2 or later once available. Until then, avoid processing untrusted archives with affected versions. The vulnerability bypasses a previous fix, so relying on older patches is insufficient.