CVE-2026-24884

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-24884

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24884.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-24884

Aliases

GHSA-cc8f-xg8v-72m3

Published

2026-02-04T19:35:56.357Z

Modified

2026-03-01T02:56:59.382124Z

Severity

8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Compressing Vulnerable to Arbitrary File Write via Symlink Extraction

Details

Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor’s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-59"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24884.json"
}

References

Affected packages

Git / github.com/node-modules/compressing

Affected ranges

Type: GIT
Repo: https://github.com/node-modules/compressing
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

1c1b72583a1fa83b28aa1b49b11bbcfef68b1449

Affected versions

1.*

1.0.0

1.1.0

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.3.0

1.3.1

1.3.2

1.4.0

1.5.0

1.5.1

1.6.0

1.6.1

1.6.2

v1.*

v1.10.0

v1.10.1

v1.10.2

v1.10.3

v1.6.2

v1.6.3

v1.7.0

v1.8.0

v1.9.0

v1.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24884.json"