CVE-2026-53486 is a vulnerability in the decompress npm package version 4.2.1 or earlier, used in Red Hat Hardened Images (dotnet8.0) and other Red Hat components. The flaw arises from insufficient path containment checks and improper handling of hardlink and symlink entries during archive extraction, allowing crafted archives to write or read files outside the intended directory. This can lead to unauthorized file access or modification, affecting confidentiality and integrity. Red Hat rates this issue as Important with a CVSS score of 8.1, reflecting that extraction is performed on locally supplied archives requiring user interaction. The original decompress package is unmaintained and has no upstream fix; the maintained fork @xhmikosr/decompress has fixes in versions 10.2.1 and 11.1.3 but is not used by Red Hat components. Red Hat has released updated RPMs for dotnet8.0 packages to address this vulnerability.

The vulnerability allows an attacker who can supply a crafted archive to cause extraction processes to create or overwrite files and links outside the intended directory. This can lead to unauthorized reading or writing of files, potentially exposing sensitive data or modifying critical files. The impact affects confidentiality and integrity but not availability. Because extraction is performed on locally supplied or build-time archives rather than arbitrary network input, exploitation requires user interaction. The vulnerability could allow bypassing security mechanisms if critical files are overwritten or read.

Red Hat has released updated RPM packages for dotnet8.0 components that fix this vulnerability. Users should apply these updates as provided by Red Hat Hardened Images RPMs. Since the original decompress package is unmaintained and no upstream fix exists, Red Hat components do not use the maintained fork with the fix. As a mitigation, only extract archives from trusted sources, run extraction as a non-root user to prevent privileged file creation, and verify that symlinks or hardlinks created during extraction resolve within the intended output directory.