CVE-2026-10732

A flaw was found in the decompress package. A remote attacker can exploit this by providing a crafted ZIP archive with two entries at the same path: a symlink to an arbitrary target and a regular file. Due to microtask processing order, the file content is written through the symlink before it is resolved, allowing writes outside the output directory. This Zip Slip bypasses path traversal protections including preventWritingThroughSymlink (CVE-2020-12265) and can lead to remote code execution.

The decompress package is vulnerable to arbitrary file write via Zip Slip when extracting a crafted ZIP containing a symlink and regular file at the same path. Microtask ordering checks readlink on the second entry before resolving the first symlink, bypassing preventWritingThroughSymlink and prior CVE-2020-12265 protections. An attacker who can supply a malicious archive for extraction may write files outside the intended output directory, potentially leading to remote code execution on the host.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.