CVE-2020-12265: Path Traversal in decompress for Node.js

Vulnerability Overview CVE ID: CVE-2020-12265 Description: An arbitrary file write vulnerability exists in the decompress package in Node.js for versions prior to 4.2.1. The vulnerability is exploitable via sequences within archive members, leading to directory traversal when symbolic links are used. Scope of Impact Affected Software: decompress package Affected Versions: Versions prior to 4.2.1 Configuration Example: Remediation Fixed Version: Upgrade to version 4.2.1 or higher. References GitHub Issue #71 GitHub Issue #73 NPM Advisory #1212 Weakness Enumeration CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-59: Improper Link Resolution Before File Access ('Link Following') Additional Information CVSS Score: 5.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Known Affected Software Configurations Configuration 1: Change History 5 change records Contact Information NVD Email: nvd@nist.gov Additional Resources NVD Menu: NVD Menu NIST Website: NIST Footer Information NIST Headquarters: 100 Bureau Drive, Gaithersburg, MD 20899 Phone: (301) 975-2000 Website: NIST Privacy and Policies Privacy Policy: Privacy Policy Accessibility: Accessibility Privacy Program: Privacy Program Copyrights: Copyrights Vulnerability Disclosure: Vulnerability Disclosure No Fear Act Policy: No Fear Act Policy FOIA: FOIA Environmental Policy: Environmental Policy Scientific Integrity: Scientific Integrity Information Quality Standards: Information Quality Standards Commerce.gov: Commerce.gov USA.gov: USA.gov Social Media Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn YouTube: YouTube RSS: RSS Email: Email Technical Support US-CERT: US-CERT Phone: 1-888-282-0870 Email: soc@us-cert.gov Other Links Webmaster: Webmaster Contact Us: Contact Us Our Other Offices: Our Other Offices Disclaimer Disclaimer: Disclaimer Copyright Information Copyright: Copyright Last Updated Last Updated: June 16, 2026 Source Source: MITRE Publication Date Publication Date: April 26, 2020 Last Modified Last Modified: June 16, 2026 Quick Information CVE Dictionary Entry: CVE-2020-12265 NVD Publication Date: April 26, 2020 NVD Last Modified: June 16, 2026 Source: MITRE References GitHub Issue #71 GitHub Issue #73 NPM Advisory #1212 Weakness Enumeration CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-59: Improper Link Resolution Before File Access ('Link Following') Known Affected Software Configurations Configuration 1: Change History 5 change records Contact Information NVD Email: nvd@nist.gov Additional Resources NVD Menu: NVD Menu NIST Website: NIST Footer Information NIST Headquarters: 100 Bureau Drive, Gaithersburg, MD 20899 Phone: (301) 975-2000 Website: NIST Privacy and Policies Privacy Policy: Privacy Policy Accessibility: Accessibility Privacy Program: Privacy Program Copyrights: Copyrights Vulnerability Disclosure: Vulnerability Disclosure No Fear Act Policy: No Fear Act Policy FOIA: FOIA Environmental Policy: Environmental Policy Scientific Integrity: Scientific Integrity Information Quality Standards: Information Quality Standards Commerce.gov: Commerce.gov USA.gov: USA.gov Social Media Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn YouTube: YouTube RSS: RSS Email: Email Technical Support US-CERT: US-CERT Phone: 1-888-282-0870 Email: soc@us-cert.gov Other Links Webmaster: Webmaster Contact Us: Contact Us Our Other Offices: Our Other Offices Disclaimer Disclaimer: Disclaimer Copyright Information Copyright: Copyright Last Updated Last Updated: June 16, 2026 Source Source: MITRE Publication Date Publication Date: April 26, 2020 Last Modified Last Modified: June 16, 2026 Quick Information CVE Dictionary Entry: CVE-2020-12265 NVD Publication Date: April 26, 2020 NVD Last Modified: June 16, 2026 Source: MITRE References GitHub Issue #71 GitHub Issue #73 NPM Advisory #1212 Weakness Enumeration CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-59: Improper Link Resolution Before File Access ('Link Following') Known Affected Software Configurations Configuration 1: Change History 5 change records Contact Information NVD Email: nvd@nist.gov Additional Resources NVD Menu: NVD Menu NIST Website: NIST Footer Information NIST Headquarters: 100 Bureau Drive, Gaithersburg, MD 20899 Phone: (301) 975-2000 Website: NIST Privacy and Policies Privacy Policy: Privacy Policy Accessibility: Accessibility Privacy Program: Privacy Program Copyrights: Copyrights Vulnerability Disclosure: Vulnerability Disclosure No Fear Act Policy: No Fear Act Policy FOIA: FOIA Environmental Policy: Environmental Policy Scientific Integrity: Scientific Integrity Information Quality Standards: Information Quality Standards Commerce.gov: Commerce.gov USA.gov: USA.gov Social Media Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn YouTube: YouTube RSS: RSS Email: Email Technical Support US-CERT: US-CERT Phone: 1-888-282-0870 Email: soc@u

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2020-12265: Path Traversal in decompress for Node.js