CVE-2026-39246
Last modified
CVE-2026-39246 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index.js line 121). EPSS estimates a 0.48% chance of exploitation in the next 30 days.
Description
decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index.js line 121). The preventWritingThroughSymlink check on line 98 only applies to file entries, not symlink creation. An attacker can craft an archive with symlink entries pointing to sensitive files outside the extraction directory (e.g., /etc/passwd), enabling information disclosure when the application reads the extracted contents.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Decompress Project | Decompress | <= 4.2.1 |
References
- https://github.com/kevva/decompress/issues/114Exploit, Vendor Advisory
- https://github.com/kevva/decompress/issues/114Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-39246?
How severe is CVE-2026-39246?
How do I fix CVE-2026-39246?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-39229Bolt CMS through 3.7.0 allows SQL Injection in the 'order' p…6.5
- CVE-2026-3923Use after free in WebMIDI in Google Chrome prior to 146.0.76…8.8
- CVE-2026-3924use after free in WindowDialog in Google Chrome prior to 146…7.5
- CVE-2026-39243decompress before 4.2.2 allows arbitrary hardlink creation d…5.5
- CVE-2026-39244adm-zip before 0.5.18 is vulnerable to denial of service via…7.5
- CVE-2026-39245decompress before 4.2.2 contains an improper path containmen…6.2
- CVE-2026-3925Incorrect security UI in LookalikeChecks in Google Chrome on…4.3
- CVE-2026-39250An authorization vulnerability exists in Innoshop 0.6.0. Aft…7.3
- CVE-2026-39253An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker…8.1
- CVE-2026-3926Out of bounds read in V8 in Google Chrome prior to 146.0.768…8.8
- CVE-2026-3927Incorrect security UI in PictureInPicture in Google Chrome p…4.3
- CVE-2026-39276The template upload feature in Emlog Pro v2.6.9 has a path t…7.2
Are you affected by CVE-2026-39246?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST