This vulnerability allows an attacker to manipulate the extraction of TAR archives in the Compressing library and create symbolic links that point to locations outside the intended extraction directory. The library does not validate these links, enabling a malicious archive to write files to arbitrary paths on the host file system, potentially overwriting critical configuration files or creating files in sensitive areas. The weakness is categorized as CWE‑59, reflecting the insecure handling of symbolic links during file operations.

The affected package is node-modules Compressing. Versions 1.10.3 and older, as well as 2.0.0, are vulnerable. The issue has been fixed in 1.10.4 and 2.0.1, so any installations still using the older releases are at risk.

The reported CVSS score is 8.4, indicating high severity. The EPSS score is below 1 %, suggesting low but nonzero exploitation likelihood at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote: an attacker can supply a malicious TAR file to any process that unpacks archives using this library. Successful exploitation could lead to privileged file writes, enabling persistence, privilege escalation, or subsequent remote code execution if executable files are written and executed.