The vulnerability in node-modules compressing arises from the isPathWithinParent utility performing a logical string check to verify if a resolved path starts with the destination directory string. However, this check does not account for the physical filesystem state, specifically symbolic links that can redirect paths outside the intended directory. Attackers can exploit this discrepancy, known as a Logical vs. Physical path divergence, using directory poisoning techniques with pre-existing symbolic links to bypass security restrictions. This flaw is tracked as CWE-59 (Improper Link Resolution Before File Access) and affects versions >=2.0.0 and <2.1.1, and versions <1.10.5. The issue was resolved in versions 2.1.1 and 1.10.5.

Successful exploitation allows an attacker to bypass directory traversal protections and access or modify files outside the intended directory, potentially leading to full compromise of confidentiality, integrity, and availability of affected systems using vulnerable versions of the compressing library.

A fix is available in node-modules compressing versions 2.1.1 and 1.10.5. Users should upgrade to these or later versions to remediate this vulnerability. There is no indication that temporary mitigations exist or that the vendor advises no action. Patch status is confirmed by the vendor advisory stating the vulnerability is fixed in these versions.