CVE-2026-101894

{
  "etk_id": "ETK-2026-52",
  "cve_id": "CVE-2026-101894",
  "display_id": "CVE-2026-101894",
  "ghsa_id": "GHSA-hrh2-vp3x-79xf",
  "euvd_id": "EUVD-2026-88365",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Symlink traversal in @xhmikosr/decompress archive extraction",
  "summary": "@xhmikosr/decompress versions before 10.2.2 and 11.1.4 can follow symlink chains in a malicious archive and access files outside the selected extraction directory. An attacker may read or modify external files when an application extracts an archive supplied by that attacker using the default API.",
  "mitigation": "Upgrade @xhmikosr/decompress to 11.1.4 or later, or to 10.2.2 or later on the 10.x release line. Replace the unmaintained decompress package, and do not process untrusted archives until migration is complete.",
  "vendor": "npm",
  "product": "npm:@xhmikosr/decompress",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 11.0.0, <= 11.1.3"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "11.1.4"
      ],
      "package_name": "@xhmikosr/decompress",
      "purl": "pkg:npm/@xhmikosr/decompress"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 10.2.1"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "10.2.2"
      ],
      "package_name": "@xhmikosr/decompress",
      "purl": "pkg:npm/@xhmikosr/decompress"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 4.2.1"
      ],
      "ecosystem": "npm",
      "fixed_versions": [],
      "package_name": "decompress",
      "purl": "pkg:npm/decompress"
    }
  ],
  "cwes": null,
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0081,
  "epss_percentile": 0.5633,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 18.98106616666667,
  "t0_at": "2026-09-28T16:57:11.440000+00:00",
  "signals": {
    "check": {
      "at": "2026-09-30T00:59:46.086494+00:00",
      "days": 1.3351232233101853,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T16:57:11.440000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-09-29T00:49:49+00:00",
      "days": 0.3282125,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T16:57:11.440000+00:00",
      "url": "https://github.com/murrez/CVE-2026-101894"
    },
    "trigger_signal": {
      "at": "2026-09-28T16:57:11.440000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T16:57:11.440000+00:00",
      "url": "https://github.com/advisories/GHSA-hrh2-vp3x-79xf"
    }
  }
}