{"vulnerability": "cve-2026-101894", "sightings": [{"uuid": "72b25472-2cbb-44b2-bfa0-5f268acbcf7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwltrgbz6p2g", "content": "\ud83d\udd34 CVE-2026-101894 - Critical (9.1)\n\nThe decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default dec...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-101894/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-28T17:31:16.271754Z"}, {"uuid": "ef4d7475-e9fc-4363-b2ca-73e963b3e19c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwlvuycgos25", "content": "\ud83d\udea8 CVE-2026-101894 \u2014 CVSS 9.1 CRITICAL\n\nThe decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(in...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-101894\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-28T18:09:01.431713Z"}, {"uuid": "7b797351-b4ba-497b-8a6f-188d99cf6350", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwlvezkhfx2i", "content": "CVE-2026-101894 - decompress\nThe decompress library used in Node.js applications may let a specially crafted archive place files outside the intended extraction folder. This could let an attacker modify\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#decompress #xhmikosr #CVE #infosec", "creation_timestamp": "2026-09-28T18:00:06.169727Z"}, {"uuid": "a79f1fe8-0897-407c-902a-e3246aea0508", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "seen", "source": "Telegram/6_Oeq2CRJE8os8WHnCwXZbDEI0tCi0KqIlGVcCySNndfyQ4", "content": "", "creation_timestamp": "2026-09-29T03:00:11.000000Z"}, {"uuid": "d0b19af9-8e5e-4738-9523-2561fc64501c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "seen", "source": "https://t.me/GithubRedTeam/103707", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-101894\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 00:50:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-101894 PoC: @xhmikosr/decompress symlink-chain archive path traversal (bypass CVE-2026-53486). Node lab + lockfile scan + mass evil.tar upload exploit. CVSS 9.1. https://pocbit.org/pocs/cve-2026-101894\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-29T01:00:07.000000Z"}, {"uuid": "e0258373-39d1-4309-b701-9764a0366b55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103707", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-101894\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 00:50:33\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-101894 PoC: @xhmikosr/decompress symlink-chain archive path traversal (bypass CVE-2026-53486). Node lab + lockfile scan + mass evil.tar upload exploit. CVSS 9.1. https://pocbit.org/pocs/cve-2026-101894\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-29T01:00:07.000000Z"}, {"uuid": "d0843b88-6c61-4932-be84-cab2a27b4c14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "published-proof-of-concept", "source": "Telegram/6_Oeq2CRJE8os8WHnCwXZbDEI0tCi0KqIlGVcCySNndfyQ4", "content": "", "creation_timestamp": "2026-09-29T03:00:11.000000Z"}, {"uuid": "e698ac91-98fa-41ad-ab0b-cb3dee8a0bc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101894", "type": "seen", "source": "https://gist.github.com/alon710/c3b0d10c48acd055c898802fe5191eff", "content": "# CVE-2026-101894: CVE-2026-101894: Arbitrary File Read/Write via Symbolic Link Chaining in @xhmikosr/decompress\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-101894\n\n## Summary\nCVE-2026-101894 is a critical path traversal vulnerability in @xhmikosr/decompress before versions 10.2.2 and 11.1.4, stemming from an incomplete hardening bypass of CVE-2026-53486 where static lexical containment checks fail to detect kernel-level resolution of crafted symlink chains, allowing arbitrary local file modification and execution.\n\n## TL;DR\nA path traversal vulnerability in @xhmikosr/decompress allows attackers to write files outside the target directory via a crafted chain of symlink entries, bypassing lexical containment checks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 9.1\n- **EPSS Score**: 0.00814\n- **Exploit Status**: PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @xhmikosr/decompress\n- decompress\n- **@xhmikosr/decompress**: < 10.2.2 (Fixed in: `10.2.2`)\n- **@xhmikosr/decompress**: < 11.1.4 (Fixed in: `11.1.4`)\n- **decompress**: <= 4.2.1 (Fixed in: `None`)\n\n## Mitigation\n\n- Upgrade @xhmikosr/decompress to fixed versions\n- Replace legacy 'decompress' library with maintained fork\n- Run extraction processes in isolated, non-root sandbox environments\n\n**Remediation Steps:**\n1. Identify vulnerable packages using npm audit\n2. Update package.json dependencies to >=10.2.2 or >=11.1.4\n3. Replace any occurrences of 'decompress' with '@xhmikosr/decompress'\n4. Rebuild lockfiles and deploy patches\n\n## References\n\n- [Official Security Advisory](https://github.com/XhmikosR/decompress/security/advisories/GHSA-hrh2-vp3x-79xf)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-101894)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-101894)\n- [Release Version 10.2.2](https://github.com/XhmikosR/decompress/releases/tag/v10.2.2)\n- [Release Version 11.1.4](https://github.com/XhmikosR/decompress/releases/tag/v11.1.4)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-101894) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T03:30:30.000000Z"}]}