CVE-2026-39246

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-39246

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39246.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-39246

Published

2026-07-09T00:00:00Z

Modified

2026-07-16T03:48:29.841029765Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index.js line 121). The preventWritingThroughSymlink check on line 98 only applies to file entries, not symlink creation. An attacker can craft an archive with symlink entries pointing to sensitive files outside the extraction directory (e.g., /etc/passwd), enabling information disclosure when the application reads the extracted contents.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "4.2.2"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39246.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/kevva/decompress

Affected ranges

Type

GIT

Repo

https://github.com/kevva/decompress

Events

Introduced

Last affected

84a8c1046946add1a6ae01c54dbebf312e4ffc85

Database specific

{
    "cpe": "cpe:2.3:a:decompress_project:decompress:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.2.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v3.*

v3.0.0

v4.*

v4.0.0

v4.1.0

v4.2.0

v4.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39246.json"