TI-2026-20070 Aliases CVE-2026-24884 GHSA-cc8f-xg8v-72m3

Compressing Vulnerable to Arbitrary File Write via Symlink Extraction

LOW 38CWE-59Published 2026-02-04 · Updated 2026-02-05

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor’s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00348 28th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed compressing (node-modules): 1.10.4compressing (npm): 2.0.1, 1.10.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
node-modules	compressing	= 2.0.0; before 1.10.4	1.10.4	Patch available	CNA
—	compressing (npm)	2.0.0 to before 2.0.1	2.0.1	Patch available	GHSA-cc8f-xg8v-72m3
—	compressing (npm)	before 1.10.4	1.10.4	Patch available	GHSA-cc8f-xg8v-72m3

compressing Vendornode-modules Affected = 2.0.0; before 1.10.4 Fixed in 1.10.4 Patch available CNA
compressing (npm) Vendor— Affected 2.0.0 to before 2.0.1 Fixed in 2.0.1 Patch available GHSA-cc8f-xg8v-72m3
compressing (npm) Vendor— Affected before 1.10.4 Fixed in 1.10.4 Patch available GHSA-cc8f-xg8v-72m3

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:node-modules:compressing::::::node.js::*	before 1.10.4	Vulnerable	node-modules
cpe:2.3:a:node-modules:compressing:2.0.0:::::node.js::	2.0.0	Vulnerable	node-modules

cpe:2.3:a:node-modules:compressing:*:*:*:*:*:node.js:*:* Versions before 1.10.4 Vulnerable ·node-modules
cpe:2.3:a:node-modules:compressing:2.0.0:*:*:*:*:node.js:*:* Versions 2.0.0 Vulnerable ·node-modules

Remediation

Fix · CNA compressing (node-modules) Fixed in 1.10.4
Fix · GHSA-cc8f-xg8v-72m3 compressing (npm) Fixed in 2.0.1 Advisory →
Fix · GHSA-cc8f-xg8v-72m3 compressing (npm) Fixed in 1.10.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-24884
2026-10-03 Alias added: GHSA-cc8f-xg8v-72m3

References

Exploit 1

https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-24884

Other 1

https://github.com/node-modules/compressing

TI-2026-29585 Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing CVSS 3.1HIGH 8.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences