ROOT-APP-NPM-CVE-2020-12265 CVE-2020-12265 in @rootio/decompress - Patched by Root

Root has patched CVE-2020-12265 in the @rootio/decompress package for Root:npm. Multiple fixed versions available...

decompress: Arbitrary File Write via Archive Extraction (Zip Slip)

All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip when extracting a ZIP archive containing two entries with the same path - the first being a symlink to an arbitrary target and the second being a regular file - the file content is writte...

PT-2026-46903

All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip when extracting a ZIP archive containing two entries with the same path - the first being a symlink to an arbitrary target and the second being a regular file - the file content is writte...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +28825 more potentially affected by CVE-2020-12265 +1 more via decompress (>=0.1.6, <=4.2.1)

decompress NPM version =0.1.6, =1.0.0, =0.0.1, =0.0.4 - 1095h-cli 1.0.1 - 10secondsofcode-custom 1.0.0 and more Source cves: CVE-2020-12265, CVE-2026-10732 Source advisory: SNYK:JS-DECOMPRESS-16415209...

CVE-2020-12265

The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal...

@adobe/helix-cli (>=0.10.6-pre.2, <=4.3.0), @c8y/cli (9.15.0) +123 more potentially affected by CVE-2020-12265 via decompress (>=4.0.0, <=4.2.0)

decompress NPM version =4.0.0, =0.10.6-pre.2, =1.1.4, =4.0.2-rc.0, =1.9.9-1, =1.0.1, =5.0.3-beta, =6.12.0, =0.9.1, =0.9.0, =0.10.5, =3.0.0-rc.0, =3.0.0-alpha.1, =0.0.1, =0.0.1-canary-publish-10b14e980f40c7d15fe9aa4b2b8dacd099133853, =3.60.0 and more Source cves: CVE-2020-12265 Source advisory:...

CVE-2020-12265

The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal...

CVE-2020-12265

The CVE-2020-12265 entry concerns the Node.js decompress package before version 4.2.1. Root cause: Directory Traversal via ../ in an archive member when a symlink is used, allowing Arbitrary File Write. Affected software: decompress (Node.js) prior to 4.2.1. Impact statements in the connected doc...