PT-2026-6213 · Unknown · Compressing

Heeqw · Published 2026-02-03 · Updated 2026-04-26 · CVE-2026-24884

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Compressing versions 1.10.3 and prior Compressing version 2.0.0

Description Compressing, a compressing and uncompressing library for Node.js, does not validate symbolic link targets when extracting TAR archives. This allows an attacker to embed symlinks that resolve to locations outside the intended extraction directory. This can lead to writing files to arbitrary locations on the host file system, potentially overwriting sensitive files or creating new files in security-critical locations. The issue occurs when restoring symbolic links during TAR archive extraction.

Recommendations Update to version 1.10.4 or later. Update to version 2.0.1 or later.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-24884

GHSA-CC8F-XG8V-72M3

Affected Products

Compressing

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24884.json · Exploit
• https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3 · Vendor Advisory
• https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6c · Patch
• https://github.com/node-modules/compressing/commit/ce1c0131c401c071c77d5a1425bf8c88cfc16361 · Patch
• https://osv.dev/vulnerability/CVE-2026-24884 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cc8f-xg8v-72m3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24884 · Security Note
• https://github.com/node-modules/compressing · Note
• https://twitter.com/CVEnew/status/2048481106178068566 · Twitter Post
• https://twitter.com/infoflowcloud/status/2048482444257411459 · Twitter Post
• https://t.me/CVEtracker/43746 · Telegram Post
• https://twitter.com/TheHackerWire/status/2019149025963045371 · Twitter Post
• https://twitter.com/dailycve/status/2045281619276095983 · Twitter Post
• https://t.me/cveNotify/153584 · Telegram Post
• https://twitter.com/CVEnew/status/2019137041670307952 · Twitter Post