CyberRota Analysis
AI-GeneratedThe vulnerability allows for the creation of arbitrary hardlinks during the extraction of archives, leading to potential file read disclosure and corruption. Specifically, an attacker can exploit this by crafting an archive with a hardlink entry that points to an absolute path on the same filesystem, allowing unauthorized access to or modification of the target file. Organizations using affected versions of the software should prioritize patching to mitigate risks associated with this vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.
Related CVEs
Other vulnerabilities affecting the same vendor(s)