CVE-2026-53486

The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix comparison, and file modes failed to remove setuid, setgid, or sticky bits. This issue is fixed in @xhmikosr/decompress versions 10.2.1 and 11.1.3.

• CWE-22
• CWE-59
• CWE-732

• https://github.com/XhmikosR/decompress/commit/281cefa00cd4275c10479bc5f1abba6b14dee8bd
• https://github.com/XhmikosR/decompress/commit/60b5299402e72b0b53ca2e55222e9a1ccb44afae
• https://github.com/XhmikosR/decompress/commit/9fcda4b0a66ca22dc8d337f9b0e7c30293c5fb89
• https://github.com/XhmikosR/decompress/commit/aca5aac415dc04a6fae5200e51368cff436a09dd
• https://github.com/XhmikosR/decompress/releases/tag/v10.2.1
• https://github.com/XhmikosR/decompress/releases/tag/v11.1.3
• https://github.com/XhmikosR/decompress/security/advisories/GHSA-mp2f-45pm-3cg9

Published

Jul 14, 2026

Last Modified

Jul 15, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53479Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…7.2
• CVE-2026-5348The Academy LMS – WordPress LMS Plugin for Complete eLearnin…5.3
• CVE-2026-53480Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…2.7
• CVE-2026-53481Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…9.8
• CVE-2026-53482Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…7.5
• CVE-2026-53483Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…9.8
• CVE-2026-53488containerd is an open-source container runtime. In versions …8.8
• CVE-2026-53489containerd is an open-source container runtime. Versions pri…6.5
• CVE-2026-5349A vulnerability was identified in Trendnet TEW-657BRM 1.00.1…8.8
• CVE-2026-53492containerd is an open-source container runtime. In Versions …9.6
• CVE-2026-5350A security flaw has been discovered in Trendnet TEW-657BRM 1…8.8
• CVE-2026-53500Thumbor is an open-source photo thumbnail service by globo.c…8.2