The vulnerability in @xhmikosr/decompress and its unmaintained upstream decompress package allows crafted archives to escape the target extraction directory via improper path containment checks and unchecked link targets (hardlinks and symlinks). The flawed string prefix comparison for path containment can be bypassed to write files outside the intended directory. Hardlinks can expose arbitrary readable files inside the output directory, and symlinks can redirect writes outside the directory. File mode bits are applied without removing setuid, setgid, or sticky bits, enabling creation of privileged files when run as root. The flaw affects all archive formats supported by decompress. The issue is fixed in @xhmikosr/decompress 10.2.1 and 11.1.3 by using path.relative for containment checks, resolving link targets before validation, and clearing unsafe mode bits. The upstream decompress package remains unpatched and unmaintained, so migration to the fixed fork is required.

An attacker who can supply a crafted archive can cause files or links to be created outside the intended extraction directory, potentially exposing sensitive files or overwriting arbitrary files. The ability to create setuid or setgid files when extraction runs as root increases the risk of privilege escalation. This vulnerability affects any system extracting untrusted archives using affected versions of decompress or @xhmikosr/decompress, which is common in CI pipelines, container environments, and install scripts. The vulnerability has a critical severity rating due to the potential for arbitrary file exposure and privilege escalation.

A fix is available in @xhmikosr/decompress versions 10.2.1 and 11.1.3. Users should upgrade to version 11.1.3 or later. The upstream decompress package is unmaintained and contains the vulnerability in all versions through 4.2.1; migration to the maintained fork is necessary. As a workaround, only extract archives from trusted sources and run extraction processes as non-root users to prevent creation of privileged files. After extraction, verify that no symlinks or hardlinks point outside the target directory and that no files have unexpected mode bits such as setuid or setgid.