CVE-2026-53486 is a security flaw in the decompress npm package bundled in Red Hat Hardened Images RPMs, including dotnet8.0 components. The vulnerability arises from improper path containment checks and failure to sanitize file modes during archive extraction, allowing crafted archives to create or overwrite files and links outside the intended directory. This can lead to unauthorized file read/write operations, potentially compromising system confidentiality and integrity. Red Hat's affected products use an unmaintained decompress package version 4.2.1 or earlier, which lacks an upstream fix. The maintained fork @xhmikosr/decompress has fixed this issue in versions 10.2.1 and 11.1.3, but Red Hat components do not use this fork. Red Hat has issued updated RPMs to mitigate the vulnerability. The CVSS score assigned by Red Hat is 8.1 (Important), considering that exploitation requires user interaction and extraction is performed on locally supplied archives rather than arbitrary network input.

The vulnerability allows a remote attacker who can supply a crafted archive to cause arbitrary file creation or modification outside the intended extraction directory. This can lead to unauthorized reading or writing of files, potentially exposing sensitive data or allowing modification of critical files. The flaw affects confidentiality and integrity but does not impact availability. Exploitation requires user interaction, such as extracting a malicious archive locally. The Red Hat score of 8.1 reflects these factors. There are no known exploits in the wild at this time.

A patch is available from Red Hat as updated RPM packages for the affected dotnet8.0 components in Red Hat Hardened Images. Users should apply these updates promptly. Since the original decompress package is unmaintained and no upstream fix exists, Red Hat recommends extracting archives only from trusted sources, performing extraction as a non-root user to prevent privileged file creation, and verifying that symlinks and hardlinks resolve within the intended output directory. These mitigations reduce the risk of exploitation until updates are applied.