Decompress: Archive extraction can create files and links outside of the target directory

Description

When extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes the parsed entries, so it affects every format decompress handles: tar, tar.gz, tar.bz2, and zip by default, plus any others added through the plugins option.

Recommendation

Update the @xhmikosr/decompress package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 11.0.0, < 11.1.3

  < 10.2.1**

• Patched version(s): **11.1.3

  10.2.1**

References

• GHSA-mp2f-45pm-3cg9
• CVE-2026-53486
• CWE-22
• CWE-59
• CWE-732
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6