decompress project records
4 published records for vendor decompress project.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 75%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2
- CWE-59 Improper Link Resolution Before File Access ('Link Following')2
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
4 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
40Plan | CVE-2020-12265No exploit | The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, decompress project · decompress · CWE-22 | Critical9.8 | 2.1%Apr 26, 2020 |
30Monitor | CVE-2026-39246No exploit | decompress before 4.2.2 allows arbitrary symlink creation during archive extraction.decompress project · decompress · CWE-59 | High7.5 | 0.6%Jul 9, 2026 |
24Monitor | CVE-2026-39245No exploit | decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write.decompress project · decompress · CWE-22 | Medium6.2 | 0.3%Jul 9, 2026 |
22Monitor | CVE-2026-39243No exploit | decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption.decompress project · decompress · CWE-59 | Medium5.5 | 0.3%Jul 9, 2026 |
- CVE-2020-1226540Plan
The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used,
CriticalCVSS 9.8No exploitEPSS 2%decompress project · decompressApr 26, 2020
- CVE-2026-3924630Monitor
decompress before 4.2.2 allows arbitrary symlink creation during archive extraction.
HighCVSS 7.5No exploitEPSS 0%decompress project · decompressJul 9, 2026
- CVE-2026-3924524Monitor
decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write.
MediumCVSS 6.2No exploitEPSS 0%decompress project · decompressJul 9, 2026
- CVE-2026-3924322Monitor
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption.
MediumCVSS 5.5No exploitEPSS 0%decompress project · decompressJul 9, 2026