CVE-2026-39243

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.

• CWE-59

• https://github.com/kevva/decompressProduct
• https://github.com/kevva/decompress/issues/113Exploit, Vendor Advisory
• https://www.npmjs.com/package/decompressProduct
• https://github.com/kevva/decompress/issues/113Exploit, Vendor Advisory

Published

Jul 9, 2026

Last Modified

Jul 13, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3920Out of bounds memory access in WebML in Google Chrome prior …8.8
• CVE-2026-3921Use after free in TextEncoding in Google Chrome prior to 146…8.8
• CVE-2026-3922Use after free in MediaStream in Google Chrome prior to 146.…8.8
• CVE-2026-39229Bolt CMS through 3.7.0 allows SQL Injection in the 'order' p…6.5
• CVE-2026-3923Use after free in WebMIDI in Google Chrome prior to 146.0.76…8.8
• CVE-2026-3924use after free in WindowDialog in Google Chrome prior to 146…7.5
• CVE-2026-39244adm-zip before 0.5.18 is vulnerable to denial of service via…7.5
• CVE-2026-39245decompress before 4.2.2 contains an improper path containmen…6.2
• CVE-2026-39246decompress before 4.2.2 allows arbitrary symlink creation du…7.5
• CVE-2026-3925Incorrect security UI in LookalikeChecks in Google Chrome on…4.3
• CVE-2026-39250An authorization vulnerability exists in Innoshop 0.6.0. Aft…7.3
• CVE-2026-39253An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker…8.1