CVE-2026-24884

Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor’s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1.

• CWE-59

• https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6cPatch
• https://github.com/node-modules/compressing/commit/ce1c0131c401c071c77d5a1425bf8c88cfc16361Patch
• https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3Exploit, Vendor Advisory

Published

Feb 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24875Integer Overflow or Wraparound vulnerability in yoyofr modiz…7.8
• CVE-2026-2488The ProfileGrid – User Profiles, Groups and Communities plug…4.3
• CVE-2026-24880Inconsistent Interpretation of HTTP Requests ('HTTP Request/…7.5
• CVE-2026-24881In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData…9.8
• CVE-2026-24882In GnuPG before 2.5.17, a stack-based buffer overflow exists…7.8
• CVE-2026-24883In GnuPG before 2.5.17, a long signature packet length cause…5.5
• CVE-2026-24885Kanboard is project management software focused on Kanban me…8
• CVE-2026-24887Claude Code is an agentic coding tool. Prior to version 2.0.…8.8
• CVE-2026-24888Maker.js is a 2D vector line drawing and shape modeling for …9.8
• CVE-2026-24889soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic …5.3
• CVE-2026-2489The TP2WP Importer plugin for WordPress is vulnerable to Sto…4.4
• CVE-2026-24890OpenEMR is a free and open source electronic health records …6.5