These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The decompress package before version 4.2.2 allows for arbitrary symlink creation during archive extraction. This vulnerability arises from the lack of validation when processing symlink entries in an archive. Specifically, the x.linkname field from the archive is directly passed to fs.symlink() without proper checks. This oversight enables an attacker to craft an archive with symlinks pointing to sensiti [truncated]
CVE-2026-39245 is a directory traversal and arbitrary file write vulnerability in the decompress package before version 4.2.2. The vulnerability exists due to a flawed path containment check in the safeMakeDir function and extraction path validation, which allows an attacker to write arbitrary files to directories adjacent to the extraction target. This vulnerability can be exploited by an attacker to byp [truncated]
CVE-2026-39243 is a vulnerability in the decompress package before version 4.2.2 that allows for arbitrary hardlink creation during archive extraction. This can lead to file read disclosure and file corruption. The vulnerability is due to the lack of validation when processing hardlink entries in the archive, specifically in the index.js file at line 113. The decompress package is used in various applicat [truncated]
CVE-2026-10732 is a vulnerability in the decompress package that allows for arbitrary file writes via archive extraction (Zip Slip). An attacker can write arbitrary files on the host filesystem, potentially leading to remote code execution, by providing a specially crafted ZIP archive. This vulnerability bypasses all existing path traversal protections, including preventWritingThroughSymlink, added as par [truncated]