Read the docs
TI-2026-69657 Aliases CVE-2026-107709GHSA-28q5-x45v-4c4c

Bower decompress-zip has a path traversal vulnerability

Priority LOW 36CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The flaw in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive with entries that resolve to prefix-sibling directories can write files outside the intended extraction directory. Exploitation may allow arbitrary file overwrite, application compromise, or remote code execution, depending on the target environment and writable sibling paths.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/decompress-zip.js` improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause files to be written outside the intended extraction directory. Successful exploitation may allow arbitrary file overwrite, application compromise, or remote code execution depending on the target environment and writable sibling paths.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0023 13th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Bower Decompress-Zipdecompress-zipup to 0.3.3—No fix listedCNA

Remediation

No fixed version of decompress-zip is listed, so no patched release is available according to the source data. Avoid extracting ZIP archives from untrusted sources with decompress-zip through version 0.3.3 until a fixed release is published.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-107709
  2. 2026-10-09 Alias added: GHSA-28q5-x45v-4c4c
  3. 2026-10-09 CVSS score added · CISA ADP
  4. 2026-10-09 Weakness changed · CISA ADP
  5. 2026-10-09 CISA SSVC decision points changed

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences