CVE-2026-53486

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53486", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-09T17:05:25.058Z", "datePublished": "2026-07-14T20:07:14.190Z", "dateUpdated": "2026-07-15T13:26:56.864Z"}, "containers": {"cna": {"title": "decompress: Archive extraction can create files and links outside the target directory", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-732", "lang": "en", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9"}, {"name": "https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd", "tags": ["x_refsource_MISC"], "url": "https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd"}, {"name": "https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae", "tags": ["x_refsource_MISC"], "url": "https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae"}, {"name": "https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89", "tags": ["x_refsource_MISC"], "url": "https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89"}, {"name": "https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd", "tags": ["x_refsource_MISC"], "url": "https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd"}, {"name": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.1"}, {"name": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.3"}], "affected": [{"vendor": "XhmikosR", "product": "decompress", "versions": [{"version": "< 10.2.1", "status": "affected"}, {"version": ">= 11.0.0, < 11.1.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T20:07:14.190Z"}, "descriptions": [{"lang": "en", "value": "The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3."}], "source": {"advisory": "GHSA-mp2f-45pm-3cg9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T13:24:13.932436Z", "id": "CVE-2026-53486", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T13:26:56.864Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53486", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-15T13:24:13.932436Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T13:24:15.533Z"}}], "cna": {"title": "decompress: Archive extraction can create files and links outside the target directory", "source": {"advisory": "GHSA-mp2f-45pm-3cg9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "XhmikosR", "product": "decompress", "versions": [{"status": "affected", "version": "< 10.2.1"}, {"status": "affected", "version": ">= 11.0.0, < 11.1.3"}]}], "references": [{"url": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9", "name": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd", "name": "https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae", "name": "https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89", "name": "https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd", "name": "https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.1", "name": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.3", "name": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T20:07:14.190Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53486", "state": "PUBLISHED", "dateUpdated": "2026-07-15T13:26:56.864Z", "dateReserved": "2026-06-09T17:05:25.058Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-14T20:07:14.190Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "decompress", "vendor": "XhmikosR", "versions": [{"status": "affected", "version": "< 10.2.1"}, {"status": "affected", "version": ">= 11.0.0, < 11.1.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3."}, {"lang": "es", "value": "El paquete decompress para Node.js extrae archivos. Antes de 10.2.1 y 11.1.3, la extracci\u00f3n de archivos puede crear archivos y enlaces fuera del directorio de destino. Al extraer un archivo a un directorio, un archivo manipulado puede leer o escribir archivos fuera de ese directorio porque las entradas de enlaces duros y enlaces simb\u00f3licos se crean sin verificar a d\u00f3nde apuntan los destinos, la contenci\u00f3n de rutas utilizaba una comparaci\u00f3n de prefijo de cadena, y los modos de archivo no lograron eliminar los bits setuid, setgid o sticky. Este problema est\u00e1 solucionado en las versiones 10.2.1 y 11.1.3 de @xhmikosr/decompress."}], "id": "CVE-2026-53486", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53486", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T13:24:13.932436Z", "version": "2.0.3"}}]}, "published": "2026-07-14T21:17:05.447", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd"}, {"source": "security-advisories@github.com", "url": "https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae"}, {"source": "security-advisories@github.com", "url": "https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89"}, {"source": "security-advisories@github.com", "url": "https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd"}, {"source": "security-advisories@github.com", "url": "https://github.com/XhmikosR/decompress/releases/tag/v10.2.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/XhmikosR/decompress/releases/tag/v11.1.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-732"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "decompress: @xhmikosr/decompress: Decompress: Arbitrary file read/write via crafted archive extraction", "id": "2500679", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500679"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in the decompress package for Node.js. A remote attacker can exploit this vulnerability by crafting a malicious archive. When the archive is extracted, it can create files and links outside the intended directory, leading to unauthorized reading or writing of files. This is due to improper handling of hardlink and symlink entries, insufficient path containment checks, and failure to remove setuid, setgid, or sticky bits from file modes. This can result in high confidentiality and integrity impacts."], "mitigation": {"lang": "en:us", "value": "There is no upstream fix for the original, unmaintained decompress npm package used by these components (last release 4.2.1). The maintained fork, @xhmikosr/decompress, resolves this issue in versions 10.2.1 and 11.1.3, but is not used by any affected Red Hat component. As a general mitigation, only extract archives from trusted sources with the affected tooling, run extraction as a non-root user to prevent the setuid/setgid/sticky-bit issue from creating a privileged file, and verify that any symlinks or hardlinks produced by extraction resolve inside the intended output directory."}, "name": "CVE-2026-53486", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Out of support scope", "package_name": "rhacm2/volsync-operator-bundle", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Out of support scope", "package_name": "rhacm2/volsync-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "decompress", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "impact": "important", "package_name": "dotnet8.0", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-14T20:07:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53486\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53486\nhttps://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd\nhttps://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae\nhttps://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89\nhttps://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd\nhttps://github.com/XhmikosR/decompress/releases/tag/v10.2.1\nhttps://github.com/XhmikosR/decompress/releases/tag/v11.1.3\nhttps://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9"], "statement": "Red Hat Build of Keycloak, Red Hat Advanced Cluster Management (VolSync), Red Hat Hardened Images (dotnet8.0), and the Fedora/EPEL yarnpkg packages bundle the original, unmaintained npm decompress package (version 4.2.1 or earlier), which does not receive an upstream fix for this issue. None of these components use the actively maintained @xhmikosr/decompress fork that received the fix in versions 10.2.1 and 11.1.3. Red Hat rates this issue with a CVSS score of 8.1 (Important), reflecting that in these products archive extraction is performed on locally supplied or build-time archives rather than automatically on arbitrary network-supplied input, which Red Hat scores as requiring user interaction (UI:R) in contrast to the upstream CVSS score of 9.1.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.2.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0,11.1.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "decompress", "source": "cna", "vendor": "XhmikosR"}, "product": "decompress", "vendor": "xhmikosr"}], "created": "2026-07-16T13:30:04.092811+00:00", "updated": "2026-07-31T05:15:03.158882+00:00", "vendors": ["xhmikosr", "xhmikosr$PRODUCT$decompress"]}