Alessandro Mizzaro

**Name of the Vulnerable Software and Affected Versions** decompress (affected versions not specified) **Description** The software is susceptible to Arbitrary File Write via Archive Extraction, also known as Zip Slip. This occurs when extracting a ZIP archive containing two entries with the same path: a symlink to an arbitrary target and a regular file. Due to the microtask processing order, the system checks `readlink` for the second file before resolving the symlink for the first, allowing file content to be written through the symlink to a target location outside the output directory. This bypasses existing path traversal protections, including `preventWritingThroughSymlink`. An attacker can write arbitrary files to the host filesystem, which may lead to remote code execution by providing a specially crafted ZIP archive. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.