Threat Intelligence Database

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink entries so that a later entry resolves outside the output directory. This allows files outside output to be read or written, and overwriting startup scripts or configuration can lead to remote code execution. The maintained @xhmikosr/decompress package is fixed in 10.2.2 and 11.1.4, but the separately affected unmaintained decompress package remains unpatched through 4.2.1. This vulnerability results from a bypass of the incomplete hardening for CVE-2026-53486. @xhmikosr/decompress is fixed in versions 10.2.2 and 11.1.4.

This update includes the following RPMs: dotnet8.0: * aspnetcore-runtime-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * aspnetcore-runtime-dbg-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * aspnetcore-targeting-pack-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-apphost-pack-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-hostfxr-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-runtime-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-runtime-dbg-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-sdk-8.0-8.0.128-1.2.hum1 (aarch64, x86_64) * dotnet-sdk-8.0-source-built-artifacts-8.0.128-1.2.hum1 (aarch64, x86_64) * dotnet-sdk-dbg-8.0-8.0.128-1.2.hum1 (aarch64, x86_64) * dotnet-targeting-pack-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-templates-8.0-8.0.128-1.2.hum1 (aarch64, x86_64) * dotnet8.0-8.0.128-1.2.hum1.src (src) Security Fix(es): dotnet8.0: * CVE-2026-53486

A vulnerability in decompress versions before 4.2.2 allows an attacker to create arbitrary hardlinks during archive extraction. This occurs because the x.linkname field from the archive is used without validation when processing hardlink entries, enabling an attacker to link to any file on the same filesystem. This can lead to unauthorized reading and overwriting of files, causing file disclosure and corruption. The vulnerability is limited to files on the same filesystem and does not affect directories. A patch is available to address this issue.

decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index.js line 121). The preventWritingThroughSymlink check on line 98 only applies to file entries, not symlink creation. An attacker can craft an archive with symlink entries pointing to sensitive files outside the extraction directory (e.g., /etc/passwd), enabling information disclosure when the application reads the extracted contents.

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function (index.js line 29) and the extraction path validation (index.js line 106) use String.indexOf() to verify the resolved path is within the output directory: realDestinationDir.indexOf(realOutputPath) !== 0. This check is flawed because it does not enforce a path separator boundary. For example, "/tmp/app_config".indexOf("/tmp/app") returns 0, incorrectly passing the check even though /tmp/app_config is outside /tmp/app. Combined with the unvalidated symlink creation in the same package, an attacker can write arbitrary files to directories adjacent to the extraction target. This is a bypass of the fix for CVE-2020-12265. The correct check requires appending a path separator: realParentPath.indexOf(realOutputPath + path.sep) !== 0.

All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same path - the first being a symlink to an arbitrary target and the second being a regular file - the file content is written through the symlink to the target location outside the output directory. This is due to the microtask processing order that checks readlink for the second file before resolving symlink for the first file. An attacker can write arbitrary file on the host filesystem potentially leading to remote code execution by providing a specially crafted ZIP archive. **Note:** This bypasses all existing path traversal protections including preventWritingThroughSymlink, added as a part of the fix for [CVE-2020-12265](https://security.snyk.io/vuln/SNYK-JS-DECOMPRESS-557358).