CVE-2026-39246: Arbitrary Symlink Creation in decompress Library – HIGH Risk

Technical summary

CVE-2026-39246 is an improper symlink handling vulnerability in the decompress library. The vulnerability exists in index.js at line 121, where the x.linkname field from archive symlink entries is passed directly to fs.symlink() without validation. The existing preventWritingThroughSymlink check (line 98) only applies to regular file entries and does not cover symlink creation, leaving a path traversal vector open. An attacker can craft an archive with symlink entries containing paths like /etc/passwd, and upon extraction, these symlinks will be created pointing outside the extraction directory. Applications that subsequently read or process the extracted symlink targets may inadvertently access or disclose sensitive information.

Business impact

Organizations using the decompress library to process archives from untrusted sources face information disclosure risks. If an application extracts malicious archives and then reads the contents, an attacker can direct the application to expose system files or sensitive application data. This is particularly concerning for file processing pipelines, backup systems, or any service that automatically extracts user-supplied archives. The impact is limited to confidentiality; the vulnerability does not directly enable file modification or system availability attacks, but exposed sensitive data could facilitate further attacks.

Affected systems

The decompress project (decompress package) versions prior to 4.2.2 are affected. Any application or service that uses this library to extract archives should be assessed. The vulnerability affects the library itself rather than a specific operating system or platform, so it impacts users across Linux, Windows, and macOS environments where decompress is deployed.

Exploitability

This vulnerability is exploitable with low complexity. An attacker needs only to craft a malicious archive file with symlink entries pointing to sensitive paths—no special authentication or user interaction beyond archive extraction is required. The CVSS score of 7.5 (HIGH) reflects the network-accessible, low-complexity nature of the attack. However, practical impact depends on what happens after extraction: if the application merely creates the symlinks and does not read them, risk is lower. If the application processes extracted contents, the risk is higher.

Remediation

Upgrade the decompress library to version 4.2.2 or later. This patch version includes validation of symlink targets to prevent creation of symlinks pointing outside the extraction directory. Organizations should prioritize patching in environments where the library processes untrusted archives. Additionally, consider implementing defense-in-depth measures such as extracting archives in sandboxed or restricted filesystem contexts, and validating symlink targets before reading extracted contents.

Patch guidance

Update the decompress dependency to version 4.2.2 or newer. For npm users, run 'npm update decompress' or modify package.json to decompress@^4.2.2. Verify the patch addresses symlink validation by reviewing the security advisory from the decompress project maintainers. After patching, rebuild and redeploy applications that depend on this library. Test with known malicious archives (e.g., symlinks pointing to /etc/passwd) in a controlled environment to confirm the patch prevents unwanted symlink creation.

Detection guidance

Monitor for unusual symlink creation during archive extraction processes. In containerized or sandboxed environments, log and alert on symlink operations that target paths outside the intended extraction directory. Review application logs for errors when reading symlinked files, which may indicate an attempted exploit. If you have source code access, search for direct calls to decompress on untrusted input and verify the library version being used. Scan your software bill of materials (SBOM) for decompress versions below 4.2.2.

Why prioritize this

While not currently in the CISA KEV catalog, this vulnerability warrants prompt patching due to its HIGH CVSS score, low attack complexity, and network accessibility. The information disclosure risk is direct and does not require exploit complexity. Prioritize patching in any service that processes archives from external users, particularly in security-sensitive environments (secrets management, configuration systems, backup platforms).

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) Network Attack Vector—the vulnerability can be exploited remotely by providing a crafted archive; (2) Low Attack Complexity—no special conditions or user interaction beyond normal archive extraction; (3) No Authentication Required; (4) High Impact on Confidentiality—sensitive files outside the extraction directory can be exposed; (5) No direct Impact on Integrity or Availability. The score does not account for contextual mitigations (e.g., extracted archives only processed in isolated contexts), which may lower practical risk in some deployments.

Frequently asked questions