TI-2026-28286 CVE-2026-39246 · GHSA-m5fg-qjq5-56fv
decompress before 4.2.2 allows arbitrary symlink creation during archive extraction.
Priority HIGH 72
decompress before 4.2.2 allows arbitrary symlink creation during archive extraction.
Decompress Project
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Decompress Project records in CISA KEVNo Decompress Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records
TI-2026-28285 CVE-2026-39245 · GHSA-qcj4-cj8p-fhf4
decompress before 4.2.2 contains an improper path containment check that enables…
Priority MEDIUM 61
decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write.
TI-2026-28283 CVE-2026-39243 · GHSA-jwp9-9v96-94mx
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction…
Priority MEDIUM 58
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption.
TI-2020-09798 CVE-2020-12265 · GHSA-qgfr-5hqp-vrw9
The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via…
Priority MEDIUM 46
The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.