GHSA-jwp9-9v96-94mx

Suggest an improvement
Source
https://github.com/advisories/GHSA-jwp9-9v96-94mx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-jwp9-9v96-94mx/GHSA-jwp9-9v96-94mx.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-jwp9-9v96-94mx
Aliases
Downstream
Published
2026-07-10T00:31:25Z
Modified
2026-08-13T14:41:17Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
decompress allows arbitrary hardlink creation during archive extraction
Details

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.

Database specific 
{
    "cwe_ids": [
        "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-13T14:18:43Z",
    "nvd_published_at": "2026-07-09T22:17:04Z",
    "severity": "MODERATE"
}
References

Affected packages

npm / decompress

Package

Name
decompress
View open source insights on deps.dev
Purl
pkg:npm/decompress

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
4.2.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-jwp9-9v96-94mx/GHSA-jwp9-9v96-94mx.json"