Skip to content
Critical Vulnerability CVE-2026-101894 Exploited via Node.js Archive Extraction

Critical Vulnerability CVE-2026-101894 Exploited via Node.js Archive Extraction

First seen 29 Sep 2026, 02:06 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 29, 2026 at 02:07 UTC
  • •CVE-2026-101894 allows RCE via symlink exploitation in Node.js archive extraction.
  • •The vulnerability affects both `@xhmikosr/decompress` and the unmaintained `decompress` package.
  • •Users must upgrade to versions 10.2.2 or 11.1.4 to mitigate the risk.

A critical vulnerability, CVE-2026-101894, was disclosed on September 28, 2026, affecting Node.js packages `@xhmikosr/decompress` and the unmaintained `decompress`. This flaw allows attackers to read and write files outside the intended output directory through symlink chains, potentially leading to remote code execution (RCE). The vulnerability was reported to be still unfixed in the `decompress` package version 4.2.1 and earlier. A proof-of-concept (PoC) was released, demonstrating the exploit's capability to overwrite sensitive files. The CVE has a CVSS score of 9.1, indicating its critical nature. Users are advised to upgrade to patched versions 10.2.2 or 11.1.4 of `@xhmikosr/decompress`. The exploit can be executed via common upload paths, making it a significant risk for applications that utilize these libraries. The vulnerability is particularly concerning for CI/CD pipelines and containerized applications that handle untrusted archives.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2007-08-28
CVE-2007-4559 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-07-14
CVE-2026-53486 published
A related vulnerability was published, indicating prior issues in the same library context.
N/A
2026-09-26
Vulnerability confirmed unfixed
The `decompress` package was confirmed to remain unfixed in version 2.2.30, with unchanged extraction code.
Sploitus
2026-09-28
CVE-2026-101894 published
A critical vulnerability in Node.js archive extraction was disclosed, allowing file system manipulation via symlink chains.
Sploitus

More articles in this cluster (2)

Following this threat?

Track CVE-2007-4559 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 3