npm/decompress CVE-2026-101894: critical 9.1, EPSS 0.81%
@xhmikosr/decompress: Path traversal via symlink chain
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 4.2.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-hrh2-vp3x-79xf#npm/decompress
- https://github.com/XhmikosR/decompress/security/advisories/GHSA-hrh2-vp3x-79xf
- https://nvd.nist.gov/vuln/detail/CVE-2026-101894
- https://github.com/XhmikosR/decompress/commit/5f4b2f64abb31bbaf1fef8975b595fd7df2558d8
- https://github.com/XhmikosR/decompress/commit/f6c88c668216d6a12c6cecf4fe0b6c70bf77050a
- https://github.com/XhmikosR/decompress
- https://github.com/XhmikosR/decompress/releases/tag/v10.2.2
- https://github.com/XhmikosR/decompress/releases/tag/v11.1.4
CVE-2026-101894 · published · modified · JSON