{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.2.1"}],"component":"decompress","cve_ids":["CVE-2026-10732"],"ecosystem":"npm","epss":0.00521,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-h39j-r5qq-r9mm","id":"tcs_01M5KFSYVMD7NESFYQSTMYET52","modified_at":"2026-08-13T05:15:07.396061707Z","published_at":"2026-06-05T09:33:46Z","references":["https://osv.dev/vulnerability/GHSA-h39j-r5qq-r9mm","https://nvd.nist.gov/vuln/detail/CVE-2026-10732","https://github.com/kevva/decompress/pull/112","https://access.redhat.com/security/cve/CVE-2026-10732","https://bugzilla.redhat.com/show_bug.cgi?id=2485376","https://gist.github.com/Alemmi/409c3cc148c39522c6d6a8538b0e1f9e","https://github.com/kevva/decompress","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10732.json","https://security.snyk.io/vuln/SNYK-JS-DECOMPRESS-16415209"],"severity":{"label":"medium","score":6.4},"sources":[{"source":"osv","source_id":"GHSA-h39j-r5qq-r9mm","url":"https://osv.dev/vulnerability/GHSA-h39j-r5qq-r9mm"}],"summary":"decompress: Arbitrary File Write via Archive Extraction (Zip Slip)"}