{"uuid": "e698ac91-98fa-41ad-ab0b-cb3dee8a0bc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "seen", "source": "https://gist.github.com/alon710/c3b0d10c48acd055c898802fe5191eff", "content": "# CVE-2026-101894: CVE-2026-101894: Arbitrary File Read/Write via Symbolic Link Chaining in @xhmikosr/decompress\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-101894\n\n## Summary\nCVE-2026-101894 is a critical path traversal vulnerability in @xhmikosr/decompress before versions 10.2.2 and 11.1.4, stemming from an incomplete hardening bypass of CVE-2026-53486 where static lexical containment checks fail to detect kernel-level resolution of crafted symlink chains, allowing arbitrary local file modification and execution.\n\n## TL;DR\nA path traversal vulnerability in @xhmikosr/decompress allows attackers to write files outside the target directory via a crafted chain of symlink entries, bypassing lexical containment checks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 9.1\n- **EPSS Score**: 0.00814\n- **Exploit Status**: PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @xhmikosr/decompress\n- decompress\n- **@xhmikosr/decompress**: < 10.2.2 (Fixed in: `10.2.2`)\n- **@xhmikosr/decompress**: < 11.1.4 (Fixed in: `11.1.4`)\n- **decompress**: <= 4.2.1 (Fixed in: `None`)\n\n## Mitigation\n\n- Upgrade @xhmikosr/decompress to fixed versions\n- Replace legacy 'decompress' library with maintained fork\n- Run extraction processes in isolated, non-root sandbox environments\n\n**Remediation Steps:**\n1. Identify vulnerable packages using npm audit\n2. Update package.json dependencies to >=10.2.2 or >=11.1.4\n3. Replace any occurrences of 'decompress' with '@xhmikosr/decompress'\n4. Rebuild lockfiles and deploy patches\n\n## References\n\n- [Official Security Advisory](https://github.com/XhmikosR/decompress/security/advisories/GHSA-hrh2-vp3x-79xf)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-101894)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-101894)\n- [Release Version 10.2.2](https://github.com/XhmikosR/decompress/releases/tag/v10.2.2)\n- [Release Version 11.1.4](https://github.com/XhmikosR/decompress/releases/tag/v11.1.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-101894) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T03:30:30.000000Z"}