decompress 2.2.1

Direct Vulnerabilities

Known vulnerabilities in the decompress package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Directory Traversal decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Directory Traversal via improper validation in the `safeMakeDir` function and extraction path validation process. An attacker can write arbitrary files outside the intended extraction directory by crafting archive entries with paths that exploit the flawed containment check and unvalidated symlink creation. How to fix Directory Traversal? There is no fixed version for `decompress`.	*
M Symlink Attack decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Symlink Attack via the `fs.link` process. An attacker can gain unauthorized access to sensitive files or corrupt file contents by crafting an archive containing a hardlink entry with a `linkname` field set to an absolute path on the same filesystem. This allows the creation of a hardlink in the extraction directory that points to any file on the same filesystem, enabling both reading and overwriting of the original file's content. This is only exploitable if the attacker is able to supply a crafted archive and the extraction occurs on the same filesystem as the target file. How to fix Symlink Attack? There is no fixed version for `decompress`.	*
M Symlink Attack decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Symlink Attack in the `symlink` handling process. An attacker can create arbitrary symbolic links outside the intended extraction directory by crafting an archive with malicious symlink entries, potentially exposing sensitive files when the application accesses the extracted contents. How to fix Symlink Attack? There is no fixed version for `decompress`.	*
H Directory Traversal decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Directory Traversal and link following during archive extraction, where symlink and hardlink entries are created without checking their targets and the directory containment check relies on a string prefix comparison. An attacker can read or write files outside the target directory, and create setuid, setgid, or sticky-bit files when extraction runs as root, by supplying an archive containing out-of-target link entries, a path that shares a prefix with the output directory such as `/srv/out-old` against `/srv/out`, or entries whose modes retain special bits that `mode & ~umask` fails to strip. Exploitation requires extracting an untrusted or attacker-influenced archive in tar, tar.gz, tar.bz2, or zip format, and the privileged-file outcome requires extraction to run as root. How to fix Directory Traversal? There is no fixed version for `decompress`.	*
M Arbitrary File Write via Archive Extraction (Zip Slip) decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same path - the first being a symlink to an arbitrary target and the second being a regular file - the file content is written through the symlink to the target location outside the output directory. This is due to the microtask processing order that checks readlink for the second file before resolving symlink for the first file. An attacker can write arbitrary file on the host filesystem potentially leading to remote code execution by providing a specially crafted ZIP archive. Note: This bypasses all existing path traversal protections including `preventWritingThroughSymlink`, added as a part of the fix for CVE-2020-12265. How to fix Arbitrary File Write via Archive Extraction (Zip Slip)? There is no fixed version for `decompress`.	*
M Arbitrary File Write via Archive Extraction (Zip Slip) decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). It is possible to bypass the security measures provided by decompress and conduct ZIP path traversal through symlinks. PoC `const decompress = require('decompress'); decompress('slip.tar.gz', 'dist').then(files => { console.log('done!'); });` How to fix Arbitrary File Write via Archive Extraction (Zip Slip)? Upgrade `decompress` to version 4.2.1 or higher.	<4.2.1

Vulnerability

Vulnerable Version

Directory Traversal

decompress is a package that can be used for extracting archives.

Affected versions of this package are vulnerable to Directory Traversal via improper validation in the safeMakeDir function and extraction path validation process. An attacker can write arbitrary files outside the intended extraction directory by crafting archive entries with paths that exploit the flawed containment check and unvalidated symlink creation.

How to fix Directory Traversal?

There is no fixed version for decompress.

Symlink Attack

decompress is a package that can be used for extracting archives.

Affected versions of this package are vulnerable to Symlink Attack via the fs.link process. An attacker can gain unauthorized access to sensitive files or corrupt file contents by crafting an archive containing a hardlink entry with a linkname field set to an absolute path on the same filesystem. This allows the creation of a hardlink in the extraction directory that points to any file on the same filesystem, enabling both reading and overwriting of the original file's content. This is only exploitable if the attacker is able to supply a crafted archive and the extraction occurs on the same filesystem as the target file.

How to fix Symlink Attack?

There is no fixed version for decompress.

Symlink Attack

decompress is a package that can be used for extracting archives.

Affected versions of this package are vulnerable to Symlink Attack in the symlink handling process. An attacker can create arbitrary symbolic links outside the intended extraction directory by crafting an archive with malicious symlink entries, potentially exposing sensitive files when the application accesses the extracted contents.

How to fix Symlink Attack?

There is no fixed version for decompress.

Directory Traversal

decompress is a package that can be used for extracting archives.

Affected versions of this package are vulnerable to Directory Traversal and link following during archive extraction, where symlink and hardlink entries are created without checking their targets and the directory containment check relies on a string prefix comparison. An attacker can read or write files outside the target directory, and create setuid, setgid, or sticky-bit files when extraction runs as root, by supplying an archive containing out-of-target link entries, a path that shares a prefix with the output directory such as /srv/out-old against /srv/out, or entries whose modes retain special bits that mode & ~umask fails to strip. Exploitation requires extracting an untrusted or attacker-influenced archive in tar, tar.gz, tar.bz2, or zip format, and the privileged-file outcome requires extraction to run as root.

How to fix Directory Traversal?

There is no fixed version for decompress.

Arbitrary File Write via Archive Extraction (Zip Slip)

decompress is a package that can be used for extracting archives.

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same path - the first being a symlink to an arbitrary target and the second being a regular file - the file content is written through the symlink to the target location outside the output directory. This is due to the microtask processing order that checks readlink for the second file before resolving symlink for the first file. An attacker can write arbitrary file on the host filesystem potentially leading to remote code execution by providing a specially crafted ZIP archive.

Note:

This bypasses all existing path traversal protections including preventWritingThroughSymlink, added as a part of the fix for CVE-2020-12265.

How to fix Arbitrary File Write via Archive Extraction (Zip Slip)?

There is no fixed version for decompress.

Arbitrary File Write via Archive Extraction (Zip Slip)

decompress is a package that can be used for extracting archives.

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). It is possible to bypass the security measures provided by decompress and conduct ZIP path traversal through symlinks.

PoC

const decompress = require('decompress');

decompress('slip.tar.gz', 'dist').then(files => {
    console.log('done!');
});

How to fix Arbitrary File Write via Archive Extraction (Zip Slip)?

Upgrade decompress to version 4.2.1 or higher.

<4.2.1

decompress@2.2.1

Extracting archives made easy

latest version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically

PoC