Directory Traversal

Overview io.kubernetes:client-java is a Client Java package. Affected versions of this package are vulnerable to Directory Traversal via the copyDirectoryFromPod process when enableTarCompressing is set to false. An attacker can create files in arbitrary locations on the client machine by...

CVE-2026-15687

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false...

CVE-2026-40931

CVE-2026-40931 affects the node module compressing up to versions 2.1.0 and 1.10.4/2.0.1 patching CVE-2026-24884. The root cause is a string-based path check in isPathWithinParent that validates resolved paths without accounting for filesystem state, enabling a Directory Poisoning bypass via pre-...

@anchan828/nest-storage (>=0.1.2, <=1.0.8), @baosight/federation-types (>=0.0.1, <=0.0.3) +98 more potentially affected by CVE-2026-40931 via compressing (>=1.1.0, <=1.10.3)

compressing NPM version =1.1.0, =0.1.2, =0.0.1, =1.3.2, =0.1.2, =0.1.2, =1.0.18, =1.3.28, =1.3.42, =1.2.33, =1.3.19, =1.3.32, =2.3.1, =1.0.0, =1.5.2, =1.5.2, =1.6.1 and more Source cves: CVE-2026-40931 Source advisory: MEND:CVE-2026-40931...

CVE-2026-40931 Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing

Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but...

binarium (2.1.3), hunter-open-sdk (>=0.0.20, <=2.0.0-beta.30) potentially affected by CVE-2026-40931 via compressing (2.0.0)

compressing NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on compressing and may be impacted: - binarium 2.1.3 - hunter-open-sdk =0.0.20, =2.0.0-beta.30 Source cves: CVE-2026-40931 Source advisory: MEND:CVE-2026-40931...

CVE-2026-40931 Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing

Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but...

CVE-2026-40931

Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but...

CVE-2026-40931: Improper Link Resolution Before File Access

Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but...

Compressing post-link vulnerabilities

Compressing is a compression and decompression tool library open sourced by nodemodules. Versions of compressing before 2.1.1 and 1.10.5 had a backlink vulnerability. This vulnerability stemmed from a flaw in the pure logical string validation within the isPathWithinParent tool, which failed to...

@anchan828/nest-storage (>=0.1.2, <=1.0.8), @baosight/federation-types (>=0.0.1, <=0.0.3) +98 more potentially affected by CVE-2026-24884 +1 more via compressing (>=1.1.0, <=1.10.3)

compressing NPM version =1.1.0, =0.1.2, =0.0.1, =1.3.2, =0.1.2, =0.1.2, =1.0.18, =1.3.28, =1.3.42, =1.2.33, =1.3.19, =1.3.32, =2.3.1, =1.0.0, =1.5.2, =1.5.2, =1.6.1 and more Source cves: CVE-2026-24884, CVE-2026-40931 Source advisory: GHSA-4C3Q-X735-J3R5...

@anchan828/nest-storage (>=0.1.2, <=1.0.8), @baosight/federation-types (>=0.0.1, <=0.0.3) +98 more potentially affected by CVE-2026-24884 +1 more via compressing (>=1.1.0, <=1.10.3)

compressing NPM version =1.1.0, =0.1.2, =0.0.1, =1.3.2, =0.1.2, =0.1.2, =1.0.18, =1.3.28, =1.3.42, =1.2.33, =1.3.19, =1.3.32, =2.3.1, =1.0.0, =1.5.2, =1.5.2, =1.6.1 and more Source cves: CVE-2026-24884, CVE-2026-40931 Source advisory: SNYK:JS-COMPRESSING-16108999...

Symlink Attack

Overview compressing is an Everything you need for compressing and uncompressing Affected versions of this package are vulnerable to Symlink Attack via the isPathWithinParent function. An attacker can overwrite arbitrary files outside the intended extraction directory by supplying a malicious...

binarium (2.1.3), hunter-open-sdk (>=0.0.20, <=2.0.0-beta.30) potentially affected by CVE-2026-24884 +1 more via compressing (2.0.0)

compressing NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on compressing and may be impacted: - binarium 2.1.3 - hunter-open-sdk =0.0.20, =2.0.0-beta.30 Source cves: CVE-2026-24884, CVE-2026-40931 Source advisory: GHSA-4C3Q-X735-J3R5...

binarium (2.1.3), hunter-open-sdk (>=0.0.20, <=2.0.0-beta.30) potentially affected by CVE-2026-24884 +1 more via compressing (2.0.0)

compressing NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on compressing and may be impacted: - binarium 2.1.3 - hunter-open-sdk =0.0.20, =2.0.0-beta.30 Source cves: CVE-2026-24884, CVE-2026-40931 Source advisory: OSV:GHSA-4C3Q-X735-J3...

binarium (2.1.3), hunter-open-sdk (>=0.0.20, <=2.0.0-beta.30) potentially affected by CVE-2026-24884 +1 more via compressing (2.0.0)

compressing NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on compressing and may be impacted: - binarium 2.1.3 - hunter-open-sdk =0.0.20, =2.0.0-beta.30 Source cves: CVE-2026-24884, CVE-2026-40931 Source advisory:...

@anchan828/nest-storage (>=0.1.2, <=1.0.8), @baosight/federation-types (>=0.0.1, <=0.0.3) +98 more potentially affected by CVE-2026-24884 +1 more via compressing (>=1.1.0, <=1.10.3)

compressing NPM version =1.1.0, =0.1.2, =0.0.1, =1.3.2, =0.1.2, =0.1.2, =1.0.18, =1.3.28, =1.3.42, =1.2.33, =1.3.19, =1.3.32, =2.3.1, =1.0.0, =1.5.2, =1.5.2, =1.6.1 and more Source cves: CVE-2026-24884, CVE-2026-40931 Source advisory: OSV:GHSA-4C3Q-X735-J3R5...

CVE-2026-24884 Compressing Vulnerable to Arbitrary File Write via Symlink Extraction

Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can caus...

binarium (2.1.3), hunter-open-sdk (>=0.0.20, <=2.0.0-beta.30) potentially affected by CVE-2026-24884 via compressing (2.0.0)

compressing NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on compressing and may be impacted: - binarium 2.1.3 - hunter-open-sdk =0.0.20, =2.0.0-beta.30 Source cves: CVE-2026-24884 Source advisory: MEND:CVE-2026-24884...

@anchan828/nest-storage (>=0.1.2, <=1.0.8), @baosight/federation-types (>=0.0.1, <=0.0.3) +98 more potentially affected by CVE-2026-24884 via compressing (>=1.1.0, <=1.10.3)

compressing NPM version =1.1.0, =0.1.2, =0.0.1, =1.3.2, =0.1.2, =0.1.2, =1.0.18, =1.3.28, =1.3.42, =1.2.33, =1.3.19, =1.3.32, =2.3.1, =1.0.0, =1.5.2, =1.5.2, =1.6.1 and more Source cves: CVE-2026-24884 Source advisory: MEND:CVE-2026-24884...