CyberRota Analysis
AI-GeneratedThe vulnerability allows for arbitrary symlink creation during archive extraction in versions prior to 4.2.2, enabling attackers to craft archives that link to sensitive files outside the intended extraction directory. This can lead to information disclosure, as the application may inadvertently read and expose sensitive data such as system files. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of unauthorized access to sensitive information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index.js line 121). The preventWritingThroughSymlink check on line 98 only applies to file entries, not symlink creation. An attacker can craft an archive with symlink entries pointing to sensitive files outside the extraction directory (e.g., /etc/passwd), enabling information disclosure when the application reads the extracted contents.
Related CVEs
Other vulnerabilities affecting the same vendor(s)