The decompress library versions prior to 4.2.2 contain a vulnerability where the x.linkname field from symlink entries in an archive is passed directly to fs.symlink() without validation. The existing preventWritingThroughSymlink check only applies to file entries and does not prevent malicious symlink creation. An attacker can craft an archive containing symlink entries that point to sensitive files outside the extraction directory (e.g., /etc/passwd), potentially causing information disclosure when the application accesses these files after extraction. There is no CVSS score or known exploits in the wild, and no patch or official remediation level has been published.

This vulnerability allows attackers to create arbitrary symbolic links during archive extraction, which can point to sensitive files outside the intended extraction directory. This may lead to information disclosure if the application reads the contents of these symlinked files. There is no indication of remote code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid extracting untrusted archives with decompress versions prior to 4.2.2 or implement additional validation to restrict symlink creation during extraction.