The decompress package versions prior to 4.2.2 implement an incorrect path containment check in the safeMakeDir function and extraction path validation. The check uses String.indexOf() to verify that the resolved extraction path is within the output directory, but fails to enforce a path separator boundary, allowing paths like '/tmp/app_config' to pass when the intended directory is '/tmp/app'. This flaw, combined with unvalidated symlink creation, enables directory traversal and arbitrary file write outside the target extraction directory. This vulnerability bypasses the fix for CVE-2020-12265. The correct mitigation requires appending a path separator to the path check to ensure proper boundary enforcement.

An attacker exploiting this vulnerability can write arbitrary files to directories outside the intended extraction directory, potentially overwriting critical files or placing malicious files in sensitive locations. This can lead to unauthorized code execution or system compromise depending on the context in which the decompress package is used.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using vulnerable versions of decompress or apply manual code corrections to enforce proper path boundary checks as described. Monitor vendor channels for updates.