CVE-2026-101894: @xhmikosr/decompress Path Traversal Vulnerability via Symlink Chain
Summary
CVE-2026-101894: @xhmikosr/decompress: Path traversal via symlink chain. Affects @xhmikosr/decompress across 2 version ranges.
< 10.2.2
>= 11.0.0, < 11.1.4
Fixed in 10.2.2 or 11.1.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @xhmikosr/decompress package is a Node.js library designed for extracting files from various archive formats. It is widely used in applications that require file decompression capabilities. However, this package is vulnerable to a path traversal issue that arises when handling untrusted archives, allowing attackers to manipulate file paths through symlink chains.
Vulnerability Detail
The vulnerability stems from the way the @xhmikosr/decompress package processes symlink entries in archives. When an untrusted archive is extracted using the default decompress(input, output) API, a crafted archive can contain a series of symlinks that lead to paths outside the designated output directory. Although lexical containment checks are performed, the kernel follows the symlinks, enabling an attacker to write and read files beyond the intended extraction directory. This could result in the overwriting of critical startup scripts or configuration files, potentially leading to remote code execution. This vulnerability is a bypass of previous hardening measures and affects any application that extracts archives controlled by an attacker.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 10.2.210.2.2npm install @xhmikosr/decompress@10.2.2 -
>= 11.0.0, < 11.1.411.1.4npm install @xhmikosr/decompress@11.1.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not feasible, avoid extracting untrusted archives with affected versions. As a temporary measure, validate entries out of band and reject any entries whose resolved path escapes the target directory.
Conclusion
The @xhmikosr/decompress package has a critical vulnerability (CVE-2026-101894) that allows for path traversal via symlink chains when extracting untrusted archives. Users are strongly advised to upgrade to the latest patched versions to mitigate the risk of exploitation. If upgrading is not an option, strict validation of archive entries is necessary to prevent potential attacks.
See every vulnerability recorded for @xhmikosr/decompress →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
Any application that extracts attacker-controlled archives using the @xhmikosr/decompress package is at risk.
Yes, the vulnerability has been patched in version 11.1.4 and backported to version 10.2.2 of the @xhmikosr/decompress package.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities using just package-lock.json. You can also check your application using the Vulert playground at Vulert Scanner.
If upgrading is not possible, ensure that you do not extract untrusted archives and validate any entries to prevent path traversal.
References
Related vulnerabilities
Recent vulnerabilities recorded for @xhmikosr/decompress.
