The decompress library extracts archives without validating that hardlink or symlink entries point inside the target directory, using a simple string prefix check. Additionally, file modes failed to remove setuid, setgid, or sticky bits, so a crafted archive can create or overwrite files anywhere on the file system where the process has permission, allowing an attacker to read or modify sensitive data or install malicious binaries.

Node.js applications that depend on the XhmikosR decompress package before release v10.2.1 or v11.1.3 are affected. Any software that imports decompress for archive handling is susceptible.

The vulnerability has a CVSS score of 9.1, indicating high severity, but its EPSS score exploitation likelihood is low. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious archive to the target application; if the process runs with elevated privileges, the impact is significantly higher. The attack vector is likely local or remote, depending on how the application obtains archives.