The decompression library is vulnerable to an arbitrary file write through Zip Slip when a ZIP archive contains two entries with the same path: a symlink pointing to an arbitrary location followed by a regular file. During extraction the microtask queue processes the symlink resolution before the second file is written, causing the file’s content to be written via the symlink to a target location outside the intended output directory. This flaw, classified as CWE‑29 and CWE‑22, allows an attacker to create or overwrite arbitrary files on the host filesystem, potentially leading to remote code execution if the written file is executable or otherwise trusted by the application. The impact is confined to the execution environment of the application; if the application runs with sufficient privileges, the attacker can overwrite critical system files.

All releases of the JavaScript package "decompress" are affected. No specific version range is excluded, so any dependency that pulls in this library remains vulnerable until an updated version is used.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score is 0.00057, implying a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting that public exploitation is not yet confirmed. The likely attack vector is through the reception of a specially crafted ZIP archive—such as a file upload, an HTTP response, or a network payload—processed by the application’s extraction routine. The main prerequisite for exploitation is the ability to supply such a crafted archive to the vulnerable component. Once written, modifications to key files can lead to a full compromise if the environment is not properly isolated.