CVE-2026-10732: Zip Slip Vulnerability in decompress Package – Arbitrary File Write Risk

Technical summary

CVE-2026-10732 is a Zip Slip variant affecting the decompress package across all versions. The root cause lies in microtask processing order within the archive extraction logic. When extracting a ZIP with duplicate-path entries (symlink followed by regular file with the same name), the second entry's readlink check executes before the first entry's symlink resolution completes. This allows file content to traverse the symlink and write outside the extraction root. The vulnerability explicitly bypasses the preventWritingThroughSymlink mitigation introduced for CVE-2020-12265, indicating the original path-traversal defense was insufficient against this specific attack pattern. Affected systems must trust ZIP contents or face arbitrary filesystem writes.

Business impact

Organizations relying on decompress for handling user-supplied or untrusted ZIP archives face direct remote code execution risk. If the library is used in file-upload workflows, CI/CD pipelines, or package management systems, attackers can achieve arbitrary code execution on servers processing those archives. The medium CVSS score (6.4) reflects that user interaction (crafted ZIP delivery) is required, but the impact—arbitrary write access to the filesystem—is severe. Unpatched systems could suffer data exfiltration, malware deployment, or system compromise through a single malicious archive.

Affected systems

All versions of the decompress npm package are vulnerable. Organizations should audit application dependencies to identify where decompress is used directly or indirectly (transitive dependencies). Any system extracting untrusted ZIP archives—including servers accepting file uploads, build systems unpacking artifacts, or tools automating archive processing—is at risk if decompress handles that extraction.

Exploitability

The attack requires an attacker to craft a ZIP archive with the specific dual-entry structure and deliver it to a system running vulnerable decompress code. User interaction is needed in the sense that the vulnerable code must execute and attempt extraction; however, this is trivial in automated contexts (web upload handlers, CI/CD jobs, package installers). No network exploitation or elevated privileges are necessary. The CVSS AC:H reflects the complexity of crafting the malicious ZIP, not the difficulty of delivery or impact. In practice, this is readily exploitable for any service accepting or processing ZIP uploads.

Remediation

Upgrade to a patched version of the decompress package issued after 2026-06-05. Verify the fix directly addresses Zip Slip mitigation and symlink handling in the vendor advisory. Until patching is complete, implement layered defenses: run ZIP extraction in isolated, sandboxed environments (containers, VMs); avoid extracting untrusted archives on production systems; validate ZIP contents before extraction; and consider restricting ZIP extraction capabilities if not essential to your application workflow.

Patch guidance

Check the decompress package repository and npm registry for a release dated after the vulnerability publication (2026-06-05) that explicitly addresses this Zip Slip bypass. The fix should include robust symlink detection that does not rely on processing order assumptions. Update using `npm update decompress` or equivalent in your package manager. Test the patched version in a non-production environment, especially if your application handles untrusted archives, before deploying to production. Verify that the fix does not introduce performance regressions in legitimate extraction workflows.

Detection guidance

Monitor for unusual filesystem writes outside expected directories during or immediately after ZIP extraction operations. Log all ZIP extraction attempts, including source, destination, and file listing. Use filesystem integrity monitoring (AIDE, Samhain, Osquery) to detect unauthorized file creation. In application logs, watch for symlink-related errors or skipped files during extraction—these may indicate exploit attempts. If your infrastructure processes ZIPs, enable archive scanning with updated antivirus/malware tools that detect Zip Slip signatures. Network-based detection is difficult; focus on host-level file activity and process auditing around extraction operations.

Why prioritize this

Despite a medium CVSS score, this vulnerability warrants prompt patching because it explicitly bypasses existing protections and enables arbitrary code execution on systems processing untrusted archives. Organizations with web applications accepting file uploads, package management systems, or CI/CD pipelines should prioritize patching within 30 days. Lower priority for systems that process only internal, pre-validated archives or do not extract ZIP files at all; however, transitive dependencies warrant a complete audit before deprioritizing.

Risk score, explained

The CVSS 3.1 score of 6.4 (Medium) reflects the attack vector (Network), attack complexity (High—requires crafted ZIP structure), privileges required (None), user interaction (Required—ZIP must be processed), and impact scope (Unchanged). However, the score understates risk in common deployment scenarios: automated upload handlers and CI/CD systems that extract archives without human confirmation effectively reduce user interaction friction. The underlying impact—arbitrary write access—is severe; the Medium rating primarily penalizes exploit complexity and the need for the victim system to invoke extraction. Organizations should treat this as High priority regardless of the numerical score if they process untrusted archives.

Frequently asked questions