@xhmikosr/decompress@11.0.1

@xhmikosr/decompress is an Extracting archives made easy

Affected versions of this package are vulnerable to Directory Traversal and link following during archive extraction, where symlink and hardlink entries are created without checking their targets and the directory containment check relies on a string prefix comparison. An attacker can read or write files outside the target directory, and create setuid, setgid, or sticky-bit files when extraction runs as root, by supplying an archive containing out-of-target link entries, a path that shares a prefix with the output directory such as /srv/out-old against /srv/out, or entries whose modes retain special bits that mode & ~umask fails to strip. Exploitation requires extracting an untrusted or attacker-influenced archive in tar, tar.gz, tar.bz2, or zip format, and the privileged-file outcome requires extraction to run as root.

Upgrade @xhmikosr/decompress to version 10.2.1, 11.1.3 or higher.