CVE-2026-101894
2 advisories.
npm/@xhmikosr/decompress CVE-2026-101894: critical 9.1, EPSS 0.81%
@xhmikosr/decompress: Path traversal via symlink chain
Action: Upgrade @xhmikosr/decompress to 10.2.2 or later.
npm i @xhmikosr/decompress@11.1.4npm i @xhmikosr/decompress@10.2.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 11.0.0 | 11.1.4 | - |
| 0 | 10.2.2 | - |
Fixed versions
| 11.1.4 | 10.2.2 |
Sources
- osv: GHSA-hrh2-vp3x-79xf
- https://github.com/XhmikosR/decompress/security/advisories/GHSA-hrh2-vp3x-79xf
- https://nvd.nist.gov/vuln/detail/CVE-2026-101894
- https://github.com/XhmikosR/decompress/commit/5f4b2f64abb31bbaf1fef8975b595fd7df2558d8
- https://github.com/XhmikosR/decompress/commit/f6c88c668216d6a12c6cecf4fe0b6c70bf77050a
- https://github.com/XhmikosR/decompress
- https://github.com/XhmikosR/decompress/releases/tag/v10.2.2
- https://github.com/XhmikosR/decompress/releases/tag/v11.1.4
CVE-2026-101894 · published · modified · JSON
npm/decompress CVE-2026-101894: critical 9.1, EPSS 0.81%
@xhmikosr/decompress: Path traversal via symlink chain
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 4.2.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-hrh2-vp3x-79xf#npm/decompress
- https://github.com/XhmikosR/decompress/security/advisories/GHSA-hrh2-vp3x-79xf
- https://nvd.nist.gov/vuln/detail/CVE-2026-101894
- https://github.com/XhmikosR/decompress/commit/5f4b2f64abb31bbaf1fef8975b595fd7df2558d8
- https://github.com/XhmikosR/decompress/commit/f6c88c668216d6a12c6cecf4fe0b6c70bf77050a
- https://github.com/XhmikosR/decompress
- https://github.com/XhmikosR/decompress/releases/tag/v10.2.2
- https://github.com/XhmikosR/decompress/releases/tag/v11.1.4
CVE-2026-101894 · published · modified · JSON