decompress Zip Slip Arbitrary File Write Vulnerability (CVE-2026-10732)

Vulnerability Overview Vulnerability Name: Arbitrary File Write via Archive Extraction (Zip Slip) Affected Package: decompress Severity: 6.1 (Medium) CVSS Score: 6.1 First Reported Date: April 9, 2026 CVE ID: CVE-2026-10732 CWE ID: CWE-22 Scope of Impact Vulnerability Description: Affected versions of the package contain an arbitrary file write vulnerability when extracting ZIP archives that include two entries with identical path names. The first entry is a symbolic link pointing to an arbitrary target, and the second entry is a regular file. The file content is written to the target location via the symbolic link, effectively bypassing the output directory. This occurs because the microkernel resolves the symbolic link from the first entry before checking the second file. Attackers can write arbitrary files to the host filesystem by providing a specially crafted ZIP archive, potentially leading to remote code execution. Bypassing Protections: This vulnerability bypasses all existing path traversal protections, including , which was added as part of the fix for CVE-2020-12265. Remediation Current Status: No patched version is available for . POC Code Additional Information Threat Intelligence: - Exploit Maturity: Proof of Concept - EPSS: 0.05% (17th Percentile) CVSS Base Metrics: - Attack Vector (AV): Network - Attack Complexity (AC): Low - Attack Requirements (AT): Present - Privileges Required (PR): None - User Interaction (UI): Passive - Confidentiality (VC): Low - Integrity (VI): High - Availability (VA): Low - Confidentiality (SC): None - Integrity (SI): None - Availability (SA): None References GitHub Gist GitHub PR Contact Information Snyk ID: SNYK.JS-DECOMPRESS-16415209 Publication Date: June 4, 2026 Disclosure Date: April 9, 2026 Credit: Alessandro Mizzaro Other Actions Report a New Vulnerability Found an Error? Test Your App

Goal Reached Thanks to every supporter — we hit 100%!

decompress Zip Slip Arbitrary File Write Vulnerability (CVE-2026-10732)