Vulnerability Description
decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index.js line 121). The preventWritingThroughSymlink check on line 98 only applies to file entries, not symlink creation. An attacker can craft an archive with symlink entries pointing to sensitive files outside the extraction directory (e.g., /etc/passwd), enabling information disclosure when the application reads the extracted contents.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Decompress Project | Decompress | <= 4.2.1 |
Related Weaknesses (CWE)
References
- https://github.com/kevva/decompressProduct
- https://github.com/kevva/decompress/issues/114ExploitVendor Advisory
- https://www.npmjs.com/package/decompressProduct
- https://github.com/kevva/decompress/issues/114ExploitVendor Advisory
FAQ
What is CVE-2026-39246?
CVE-2026-39246 is a vulnerability with a CVSS score of 7.5 (HIGH). decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to f...
How severe is CVE-2026-39246?
CVE-2026-39246 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-39246?
Check the references section above for vendor advisories and patch information. Affected products include: Decompress Project Decompress.