XhmikosR CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL XhmikosR CVE published 2026-07-14

CVE-2026-53486

CVE-2026-53486 decompress package vulnerability allows for file and link creation outside target directory. The decompress package for Node.js extracts archives and has a vulnerability prior to versions 10.2.1 and 11.1.3 that allows crafted archives to read or write files outside the target directory. This issue is due to hardlink and symlink entries being created without checking where targets point, pat [truncated]