Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Affects Red Hat Product Security Red HatSource GCVE Database
Not known to be exploited · fixed in 10.2.1 : patch Red Hat Product Security Red Hat soon.
Data as of 10/24/2026, 22:16:04 UTC
No CVSS score from NVD or the CNA
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.7% chance of exploitation in 30 days – higher than 54% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 10.2.1, 11.1.3
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@xhmikosr/decompress | Affected
| Fixed in
|
| npm@xhmikosr/decompress | Affected
| Fixed in
|
| npmdecompress | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Red Hat has released updated RPM packages for dotnet8.0 components that fix this vulnerability. Users should apply these updates as provided by Red Hat Hardened Images RPMs. Since the original decompress package is unmaintained and no upstream fix exists, Red Hat components do not use the maintained fork with the fix. As a mitigation, only extract archives from trusted sources, run extraction as a non-root user to prevent privileged file creation, and verify that symlinks or hardlinks created during extraction resolve within the intended output directory.
Description
This update includes the following RPMs: dotnet8.0: * aspnetcore-runtime-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * aspnetcore-runtime-dbg-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * aspnetcore-targeting-pack-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-apphost-pack-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-hostfxr-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-runtime-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-runtime-dbg-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-sdk-8.0-8.0.128-1.2.hum1 (aarch64, x86_64) * dotnet-sdk-8.0-source-built-artifacts-8.0.128-1.2.hum1 (aarch64, x86_64) * dotnet-sdk-dbg-8.0-8.0.128-1.2.hum1 (aarch64, x86_64) * dotnet-targeting-pack-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-templates-8.0-8.0.128-1.2.hum1 (aarch64, x86_64) * dotnet8.0-8.0.128-1.2.hum1.src (src) Security Fix(es): dotnet8.0: * CVE-2026-53486
Impact
The vulnerability allows an attacker who can supply a crafted archive to cause extraction processes to create or overwrite files and links outside the intended directory. This can lead to unauthorized reading or writing of files, potentially exposing sensitive data or modifying critical files. The impact affects confidentiality and integrity but not availability. Because extraction is performed on locally supplied or build-time archives rather than arbitrary network input, exploitation requires user interaction. The vulnerability could allow bypassing security mechanisms if critical files are overwritten or read.
Summary
CVE-2026-53486 is a vulnerability in the decompress npm package version 4.2.1 or earlier, used in Red Hat Hardened Images (dotnet8.0) and other Red Hat components. The flaw arises from insufficient path containment checks and improper handling of hardlink and symlink entries during archive extraction, allowing crafted archives to write or read files outside the intended directory. This can lead to unauthorized file access or modification, affecting confidentiality and integrity. Red Hat rates this issue as Important with a CVSS score of 8.1, reflecting that extraction is performed on locally supplied archives requiring user interaction. The original decompress package is unmaintained and has no upstream fix; the maintained fork @xhmikosr/decompress has fixes in versions 10.2.1 and 11.1.3 but is not used by Red Hat components. Red Hat has released updated RPMs for dotnet8.0 packages to address this vulnerability.
Weaknesses
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #6OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-606Unchecked Input for Loop Condition (opens in a new tab)
Base weakness
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
References
- access.redhat.com/errata/RHSA-2026:40415 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-53486 (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- images.redhat.com (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-59869 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40415.json (opens in a new tab)