CVE-2026-101894

CVE-2026-101894 — @xhmikosr/decompress シンボリックリンクチェーンによるパストラバーサル CVE-2026-101894 の Python 3 PoC — @xhmikosr/decompress （およびメンテナンスされていない decompress ）における Node.js のアーカイブ展開は、シンボリックリンクエントリの連鎖 を介して 出力ディレクトリ外への読み取り/書き込み を可能にします。CVE-2026-53486 のハードニングのバイパスです。CVSS 3.1 9.1 Critical 。 | ---|--- PoCbit|...

ROOT-APP-NPM-CVE-2026-53486 CVE-2026-53486 in @xhmikosr/decompress - Patched by Root

Root has patched CVE-2026-53486 in the @xhmikosr/decompress package for Root:npm. Multiple fixed versions available...

@xhmikosr/decompress: Path traversal via symlink chain

Impact When extracting an untrusted archive with the default decompressinput, output API, a crafted archive containing a chain of symlink entries can make a later entry resolve outside the output directory. The lexical containment checks pass, but the kernel follows the planted symlinks to a path...

NPM: @xhmikosr/decompress: Path traversal via symlink chain

NPM: @xhmikosr/decompress: Path traversal via symlink chain vulnerability discovered by ? in WordPress Npm decompress versions = 4.2.1...

Directory Traversal

Overview @xhmikosr/decompress is an Extracting archives made easy Affected versions of this package are vulnerable to Directory Traversal via symlink extraction in index.js, where symlinks whose targets resolve outside the output directory are not validated before being written to disk. An attack...

CVE-2026-101894 @xhmikosr/decompress: Path traversal via symlink chain

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2026-101894

The decompress package for Node.js is vulnerable to a path traversal flaw due to inadequate lexical containment checks. An attacker can provide a crafted archive with chained symlink entries to bypass directory restrictions, allowing them to read or write files outside the intended output directo...

CVE-2026-101894 @xhmikosr/decompress: Path traversal via symlink chain

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2026-101894 @xhmikosr/decompress: Path traversal via symlink chain

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2026-53486: Improper Limitation of a Pathname to a Restricted Directory

The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink...

bdy (>=1.18.27-dev, <=1.22.61-stage) potentially affected by CVE-2026-53486 via @xhmikosr/decompress (11.1.1)

@xhmikosr/decompress NPM version 11.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @xhmikosr/decompress and may be impacted: - bdy =1.18.27-dev, =1.22.61-stage Source cves: CVE-2026-53486 Source advisory: SNYK:JS-XHMIKOSRDECOMPRESS-17874438...

bdy (>=1.7.46-dev, <=1.18.26-stage), buddy-tunnel (>=1.3.19-dev, <=1.7.45-dev) potentially affected by CVE-2026-53486 via @xhmikosr/decompress (10.0.1)

@xhmikosr/decompress NPM version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @xhmikosr/decompress and may be impacted: - bdy =1.7.46-dev, =1.3.19-dev, =1.7.45-dev Source cves: CVE-2026-53486 Source advisory: OSV:GHSA-MP2F-45PM-3CG9...

bdy (>=1.18.27-dev, <=1.22.61-stage) potentially affected by CVE-2026-53486 via @xhmikosr/decompress (11.1.1)

@xhmikosr/decompress NPM version 11.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @xhmikosr/decompress and may be impacted: - bdy =1.18.27-dev, =1.22.61-stage Source cves: CVE-2026-53486 Source advisory: OSV:GHSA-MP2F-45PM-3CG9...

bdy (>=1.7.46-dev, <=1.18.26-stage), buddy-tunnel (>=1.3.19-dev, <=1.7.45-dev) potentially affected by CVE-2026-53486 via @xhmikosr/decompress (10.0.1)

@xhmikosr/decompress NPM version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @xhmikosr/decompress and may be impacted: - bdy =1.7.46-dev, =1.3.19-dev, =1.7.45-dev Source cves: CVE-2026-53486 Source advisory: SNYK:JS-XHMIKOSRDECOMPRESS-178744...