The decompress package (npm) contains a path traversal weakness (CWE‑22) before version 4.2.2. Its containment check relies on String.indexOf() without enforcing a path separator boundary, allowing a crafted entry such as "/tmp/app_config" to pass validation against "/tmp/app" and be extracted outside the intended directory. Coupled with unvalidated symbolic‑link creation, an attacker can arbitrarily write files to locations adjacent to the extraction target, potentially overwriting configuration files or deploying malicious code.

Any Node.js application or environment that depends on the decompress npm package version 4.2.1 or earlier may be vulnerable, especially when the library is used to unpack archives without additional sanitization or dependency isolation. The flaw exists in all installations of the package unless the code has been modified to use a stricter path check.

The CVSS score of 6.2 indicates moderate severity, and the EPSS score of <1% suggests a low probability of widespread exploitation at this time. The flaw is not listed in the CISA KEV catalog. The likely attack vector is an attacker supplying a crafted archive to a vulnerable decompress invocation; if extraction is performed with elevated privileges or the environment permits overwrites of critical system files, the arbitrary file write could be escalated to remote code execution or a persistent compromise.