Decompress: Archive extraction can create files and links outside of the target directory

Description

When extracting an archive to a directory, a crafted archive can read or write files outside that directory. The flaw is in the code that writes the parsed entries, so it affects every format decompress handles: tar, tar.gz, tar.bz2, and zip by default, plus any others added through the plugins option.

Recommendation

Update the @xhmikosr/decompress package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 11.0.0, < 11.1.3

  < 10.2.1**

• Patched version(s): **11.1.3

  10.2.1**

References

• GHSA-mp2f-45pm-3cg9
• CVE-2026-53486
• CWE-22
• CWE-59
• CWE-732
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory - CVE-2026-34522
• StudioCMS: REST API Missing Rank Check Allows Admin to Create Peer Admin Accounts - CVE-2026-32106
• Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files - CVE-2025-48985
• Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE) - CVE-2026-23733

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@xhmikosr/decompress