GHSA-cc8f-xg8v-72m3 Compressing Vulnerable to Arbitrary File Write via Symlink Extraction

• npm compressing: >= 2.0.0, < 2.0.1 → fixed in 2.0.1 • npm compressing: < 1.10.4 → fixed in 1.10.4

Arbitrary File Write via Symlink Extraction in `github.com/node-modules/compressing` Brief Introduction The `compressing` npm package extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor’s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. Affected Component and Versions • Component: `github.com/node-modules/compressing` • Affected Versions: ` After extraction, the output directory contains a symlink pointing to `/tmp`. The file `poc.txt` is then written through the symlink to `/tmp/poc.txt`, demonstrating an arbitrary file write outside the extraction directory. Summary `compressing` restores symlinks from TAR archives without validating their targets. By combining a malicious symlink with a subsequent file entry, an attacker can redirect extracted files to arbitrary locations on the host.