CVE-2026-24884

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24884", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-27T19:35:20.527Z", "datePublished": "2026-02-04T19:35:56.357Z", "dateUpdated": "2026-02-05T14:32:51.788Z"}, "containers": {"cna": {"title": "Compressing Vulnerable to Arbitrary File Write via Symlink Extraction", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3"}, {"name": "https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6c", "tags": ["x_refsource_MISC"], "url": "https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6c"}, {"name": "https://github.com/node-modules/compressing/commit/ce1c0131c401c071c77d5a1425bf8c88cfc16361", "tags": ["x_refsource_MISC"], "url": "https://github.com/node-modules/compressing/commit/ce1c0131c401c071c77d5a1425bf8c88cfc16361"}], "affected": [{"vendor": "node-modules", "product": "compressing", "versions": [{"version": "= 2.0.0", "status": "affected"}, {"version": "< 1.10.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T19:35:56.357Z"}, "descriptions": [{"lang": "en", "value": "Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor\u2019s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1."}], "source": {"advisory": "GHSA-cc8f-xg8v-72m3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T14:23:12.467869Z", "id": "CVE-2026-24884", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:32:51.788Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24884", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-05T14:23:12.467869Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:23:13.106Z"}}], "cna": {"title": "Compressing Vulnerable to Arbitrary File Write via Symlink Extraction", "source": {"advisory": "GHSA-cc8f-xg8v-72m3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "node-modules", "product": "compressing", "versions": [{"status": "affected", "version": "= 2.0.0"}, {"status": "affected", "version": "< 1.10.4"}]}], "references": [{"url": "https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3", "name": "https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6c", "name": "https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/node-modules/compressing/commit/ce1c0131c401c071c77d5a1425bf8c88cfc16361", "name": "https://github.com/node-modules/compressing/commit/ce1c0131c401c071c77d5a1425bf8c88cfc16361", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor\u2019s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T19:35:56.357Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24884", "state": "PUBLISHED", "dateUpdated": "2026-02-05T14:32:51.788Z", "dateReserved": "2026-01-27T19:35:20.527Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-04T19:35:56.357Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "compressing", "vendor": "node-modules", "versions": [{"status": "affected", "version": "= 2.0.0"}, {"status": "affected", "version": "< 1.10.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:node-modules:compressing:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "7FD0D71B-4E26-469A-BC9C-DCB66097E813", "versionEndExcluding": "1.10.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:node-modules:compressing:2.0.0:*:*:*:*:node.js:*:*", "matchCriteriaId": "DF61D84F-AAB3-47A3-BB3A-0D35E654643E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor\u2019s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1."}, {"lang": "es", "value": "Compressing es una librer\u00eda de compresi\u00f3n y descompresi\u00f3n para node. En las versiones 2.0.0 y 1.10.3 y anteriores, Compressing extrae archivos TAR mientras restaura enlaces simb\u00f3licos sin validar sus destinos. Al incrustar enlaces simb\u00f3licos que se resuelven fuera del directorio de extracci\u00f3n previsto, un atacante puede hacer que las entradas de archivos subsiguientes se escriban en ubicaciones arbitrarias en el sistema de archivos del host. Dependiendo de c\u00f3mo el extractor maneje los archivos existentes, este comportamiento puede permitir sobrescribir archivos sensibles o crear nuevos archivos en ubicaciones cr\u00edticas para la seguridad. Este problema ha sido parcheado en las versiones 1.10.4 y 2.0.1."}], "id": "CVE-2026-24884", "lastModified": "2026-06-17T10:23:44.837", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24884", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-05T14:23:12.467869Z", "version": "2.0.3"}}]}, "published": "2026-02-04T20:16:05.703", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6c"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/node-modules/compressing/commit/ce1c0131c401c071c77d5a1425bf8c88cfc16361"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T13:46:11.925211+00:00", "value": {"mitigation_remediation": ["Update the Compressing library to at least version 1.10.4 or 2.0.1 where the symlink validation is fixed.", "If an update is temporarily unavailable, configure the application to extract archives in a dedicated, non\u2011privileged directory and enforce strict ownership and permission checks so that even if a symlink is written, it cannot target system files.", "Enhance the extraction logic with an internal check: before following a symbolic link, verify that the resolved path remains inside the intended extraction base directory and reject or reject such links as invalid."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary File Write"}, "threat_synthesis": {"affected_systems": "The affected package is node-modules Compressing. Versions 1.10.3 and older, as well as 2.0.0, are vulnerable. The issue has been fixed in 1.10.4 and 2.0.1, so any installations still using the older releases are at risk.", "description_and_impact": "This vulnerability allows an attacker to manipulate the extraction of TAR archives in the Compressing library and create symbolic links that point to locations outside the intended extraction directory. The library does not validate these links, enabling a malicious archive to write files to arbitrary paths on the host file system, potentially overwriting critical configuration files or creating files in sensitive areas. The weakness is categorized as CWE\u201159, reflecting the insecure handling of symbolic links during file operations.", "risk_and_exploitability": "The reported CVSS score is 8.4, indicating high severity. The EPSS score is below 1\u202f%, suggesting low but nonzero exploitation likelihood at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote: an attacker can supply a malicious TAR file to any process that unpacks archives using this library. Successful exploitation could lead to privileged file writes, enabling persistence, privilege escalation, or subsequent remote code execution if executable files are written and executed."}}}}, "created": "2026-02-05T11:39:53.048066+00:00", "updated": "2026-04-18T14:00:02.174761+00:00", "vendors": ["node-modules", "node-modules$PRODUCT$compressing"]}