The decompress library prior to version 4.2.2 improperly handles symbolic link entries during archive extraction. Specifically, the x.linkname field from symlink entries is passed directly to fs.symlink() without validation, while the existing preventWritingThroughSymlink check only applies to file entries, not symlink creation. This allows an attacker to craft archives with symlinks pointing to arbitrary locations outside the extraction directory, potentially exposing sensitive files such as /etc/passwd when the application accesses the extracted contents.

An attacker can create archives containing symbolic links that point to sensitive files outside the intended extraction directory. When the application extracts and subsequently reads these symlinked files, it may disclose sensitive information. The vulnerability does not affect confidentiality directly through the extraction process but enables indirect information disclosure via crafted archives.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid extracting untrusted archives with decompress versions prior to 4.2.2 or implement additional validation to prevent symlink creation outside the extraction directory.