CVE-2026-53486
- Source
- https://cve.org/CVERecord?id=CVE-2026-53486
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53486.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-53486
- Aliases
- Downstream
CGA (8)
MINI (6)
RHSA (1)
ROOT (1)
- Published
- 2026-07-14T20:07:14Z
- Modified
- 2026-10-26T02:33:49Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- decompress: Archive extraction can create files and links outside the target directory
- Details
-
The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-22", "CWE-59", "CWE-732" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53486.json" }- References
-
- https://github.com/XhmikosR/decompress/releases/tag/v10.2.1
- https://github.com/XhmikosR/decompress/releases/tag/v11.1.3
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53486.json
- https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9
- https://nvd.nist.gov/vuln/detail/CVE-2026-53486
- https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd
- https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae
- https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89
- https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd
Affected packages
Git / github.com/xhmikosr/decompress
Affected ranges
- Type
- GIT
- Repo
- https://github.com/xhmikosr/decompress
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "10.2.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "11.0.0" }, { "fixed": "11.1.3" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "281cefa00cd4275c10479bc5f1abba6b14dee8bd" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "60b5299402e72b0b53ca2e55222e9a1ccb44afae" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "aca5aac415dc04a6fae5200e51368cff436a09dd" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v10.2.1", "range": [ { "fixed": "742ab1a8fe0e49d1437069cabe394ff89d41ae01" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v11.1.3", "range": [ { "fixed": "921c957ca09437139599d86d5f4aa963f1b3fa82" } ], "source": "REFERENCES_TAG" } ] }