CyberSecBulletin

Decompress Project vulnerabilities

We track 1 vulnerability in Decompress Project products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on July 9, 2026.

1vulnerabilities
0critical
1high
0exploited
7.5average CVSS score

Latest Decompress Project vulnerabilities

  • 7.5 High severity

    Decompress: Improper Link Resolution Before File Access

    CVE-2026-39246Decompress Project

    decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index.js line 121). The prev