CriticalGHSA-qgfr-5hqp-vrw9CVE-2020-12265

Path Traversal in decompress

Published 3 Sept 2020 · Updated 8 Nov 2023

Affected package

decompressnpm
Affected
<4.2.1
Fixed in
4.2.1
Update to the fixed version for your release line, for example:npm install decompress@4.2.1

Details

Versions of decompress prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing../.

Recommendation

Upgrade to version 4.2.1 or later.

Is GHSA-qgfr-5hqp-vrw9 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected decompress, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.