Summary
A path traversal vulnerability in the Node.js decompress package allows crafted archives to escape the intended extraction directory through chained symbolic links. An attacker who can provide or cause processing of such an archive may read or overwrite files outside the output directory, potentially resulting in remote code execution when startup scripts or configuration files are affected.
Affected context
The vulnerability affects applications that use the package's default archive-extraction API to process attacker-controlled or insufficiently trusted archives. It becomes risky when extraction occurs into a directory where symbolic links can be created and later followed, because lexical path checks alone may not reflect the filesystem path resolved by the kernel.
Exploit preconditions
- Attack surface: Archive extraction through the Node.js decompress API
- Required access: Ability to supply, upload, or influence an archive processed by the application
- Trigger point: Extraction of chained symbolic-link entries followed by later archive entries
- Why exploitation is possible: Lexical containment checks may approve a path while filesystem resolution redirects it outside the intended output directory
Why this happens
The underlying bug is incomplete protection against archive entries that create symbolic links and later rely on those links during extraction.
The package checks whether an entry's textual path appears to remain inside the destination directory, but this does not fully account for kernel-level path resolution after links have been planted. This behavior maps primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, with CWE-59: Improper Link Resolution Before File Access describing the unsafe handling of symbolic links.
Potential impact
- Files outside the extraction directory may be read
- Arbitrary files may be overwritten or modified
- Application configuration or startup scripts could be tampered with
- Application secrets or sensitive data could be disclosed
- Remote code execution may occur in affected application contexts
- Downstream services or hosts could be compromised through altered files
General mitigation guidance
Mitigation generally focuses on treating archive contents as untrusted and enforcing containment after filesystem resolution rather than relying only on lexical path checks.
Common defensive patterns include:
- Use a maintained extraction implementation with protections for symbolic links and resolved paths
- Reject or isolate symbolic-link and hard-link entries when they are not required
- Resolve candidate paths and verify that the resulting filesystem location remains within the extraction root
- Extract into a dedicated, least-privileged temporary directory
- Prevent extracted files from influencing executable startup paths or sensitive configuration locations
- Apply resource limits, sandboxing, and filesystem permissions to the extraction process
- Reduce trust in archive metadata and validate entry types before writing files
How teams detect issues like this
Organizations can identify this class of issue through:
- Static analysis and dependency review for archive extractors lacking resolved-path containment checks
- Code review signals involving archive entry paths, symbolic-link creation, and filesystem writes
- Tests using nested symbolic links, path normalization differences, and attempts to escape extraction roots
- Dependency policies that identify unmaintained or vulnerable archive-processing packages
- Runtime monitoring for unexpected writes outside designated temporary extraction directories
- Automated security review tools that flag archive traversal and unsafe link-resolution patterns
