CVE-2026-39243 Details
Description
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.
A vulnerability in the 'decompress' package, prior to version 4.2.2, allows for arbitrary hardlink creation during the extraction of archives. This issue arises because hardlink entries are processed without proper validation, enabling an attacker to craft an archive that links to any file on the same filesystem. The exploitation of this vulnerability can lead to unauthorized file reading and corruption by overwriting the original file's content. Hardlinks cannot target directories and are restricted to files within the same filesystem.
Users are advised not to extract untrusted archives with the 'decompress' package. If the vulnerability is to be addressed, the package should validate hardlink targets to ensure they do not resolve outside the output directory.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kevva/decompress/issues/113 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/kevva/decompress | [email protected] | Product |
| https://github.com/kevva/decompress/issues/113 | [email protected] | ExploitVendor Advisory |
| https://www.npmjs.com/package/decompress | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| decompress project decompress | <= 4.2.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | Initial Analysis | [email protected] |
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |