GitHub Advisoryadvisory · npm

GHSA-qgfr-5hqp-vrw9 Path Traversal in decompress

CRITICAL Published 2020-09-03 Modified 2023-04-18 Official page ↗
Aliases
CVE-2020-12265
Ecosystem
npm
Packages
decompress
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22, CWE-59
Reviewed
2020-08-31

Affected packages

• npm decompress: < 4.2.1 → fixed in 4.2.1

Description

Versions of `decompress` prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing`../`. Recommendation Upgrade to version 4.2.1 or later.

Related

Alias · CVE (1)

  • CVE-2020-12265 The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used,… vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-59 Improper Link Resolution Before File Access weakness

References