CVE-2026-39246

creationtimestamp| type| source ---|---|--- 2026-07-11 00:31:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdfxmi2yn2s...

CVE-2026-39246

decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries type === 'symlink', the x.linkname field from the archive is passed directly to fs.symlink without validation index.js line 121. The preventWritingThroughSymlink check on line 98...