Skip to content
Threat Feed
Subscribe

Product

@Xhmikosr/Decompress (<= 4.2.1)

1 brief RSS
critical advisory

Decompress Archive Extraction Vulnerability Allows Path Traversal and Privilege Escalation (CVE-2026-53486)

A critical vulnerability (CVE-2026-53486) in the `@xhmikosr/decompress` and unmaintained `decompress` npm packages allows attackers to craft malicious archives that, upon extraction, can write or read files outside the target directory, expose arbitrary file contents, or create setuid/setgid files leading to arbitrary file system modification, information disclosure, and potential privilege escalation.

PoC @xhmikosr/decompress +1 vulnerability path-traversal privilege-escalation npm supply-chain
2t 2c updated