CVE-2026-101894

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-101894
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101894.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-101894
Aliases
  • GHSA-hrh2-vp3x-79xf
Published
2026-09-28T16:57:11Z
Modified
2026-09-29T03:45:54Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
@xhmikosr/decompress: Path traversal via symlink chain
Details

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink entries so that a later entry resolves outside the output directory. This allows files outside output to be read or written, and overwriting startup scripts or configuration can lead to remote code execution. The maintained @xhmikosr/decompress package is fixed in 10.2.2 and 11.1.4, but the separately affected unmaintained decompress package remains unpatched through 4.2.1. This vulnerability results from a bypass of the incomplete hardening for CVE-2026-53486. @xhmikosr/decompress is fixed in versions 10.2.2 and 11.1.4.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22",
        "CWE-59"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101894.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "10.2.2"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/xhmikosr/decompress

Affected ranges

Type
GIT
Repo
https://github.com/xhmikosr/decompress
Events
Introduced
bbaa8c6c31bab65fea6b8a85f12ffb4ead6845f7
Fixed
18aacc5bec66f06c6dbe80b1499d684221af1068
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
84a8c1046946add1a6ae01c54dbebf312e4ffc85
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "11.0.0"
        },
        {
            "fixed":  "11.1.4"
        },
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "4.2.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v11.*
v11.0.0
v11.0.1
v11.0.2
v11.1.0
v11.1.1
v11.1.2
v11.1.3
v3.*
v3.0.0
v4.*
v4.0.0
v4.1.0
v4.2.0
v4.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101894.json"