GHSA-qgfr-5hqp-vrw9

Source

https://github.com/advisories/GHSA-qgfr-5hqp-vrw9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-qgfr-5hqp-vrw9/GHSA-qgfr-5hqp-vrw9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qgfr-5hqp-vrw9

Aliases

CVE-2020-12265

Published

2020-09-03T21:16:27Z

Modified

2023-11-08T04:02:09Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Path Traversal in decompress

Details

Versions of decompress prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing../.

Recommendation

Upgrade to version 4.2.1 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-22",
        "CWE-59"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:51:16Z",
    "nvd_published_at":  "2020-04-26T17:15:00Z",
    "severity":  "CRITICAL"
}

References

Affected packages

npm / decompress

Package

Name: decompress; View open source insights on deps.dev
Purl: pkg:npm/decompress

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.2.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-qgfr-5hqp-vrw9/GHSA-qgfr-5hqp-vrw9.json"