Based on the description, the npm package decompress is used in Node.js applications to extract archives, and it has a flaw before version 4.2.2. When a hardlink entry is encountered, the library calls fs.link with the linkname value taken directly from the archive, without performing any validation. An attacker can craft an archive where the linkname is an absolute path to an arbitrary file on the same filesystem. During extraction, that linkname creates a hardlink inside the extraction directory that shares the inode with the target file, thereby giving the process read and write access to that file. This vulnerability is a classic case of improper validation of file paths that can be used to create hardlinks (CWE‑59).

Based on the description, the npm package decompress is used in Node.js applications to extract archives, and applications that import decompress prior to version 4.2.2 are affected. The flaw is independent of the operating system or Node.js runtime version and applies to any package that accepts untrusted archives and extracts them with decompress. Web services, file import utilities, installer scripts, and backup restore tools that rely on decompress therefore face the same risk if they are unable to guarantee archive integrity.

With a CVSS score of 5.5 the vulnerability is rated medium in severity, and the EPSS score of less than 1% indicates a low current exploitation probability. The issue is not listed in the CISA KEV catalog. Nonetheless, if an attacker can supply a malicious archive to the vulnerable application, they can read or overwrite any file the application’s user account can access. The attack requires local supply of a crafted archive and does not involve remote network access or privilege escalation beyond the application’s permissions.