PT-2026-6213 · Unknown · Compressing

Heeqw · CVE-2026-24884 · Published 2026-02-03 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Compressing versions prior to 1.10.4 Compressing version 2.0.0

Description Compressing is a compression and decompression library for Node.js. The compressing.tar.uncompress() function extracts TAR archives and restores symbolic links without validating their targets. An attacker can embed symlinks that resolve outside the intended extraction directory, causing subsequent file entries to be written to arbitrary locations on the host file system. This can lead to the overwriting of sensitive files or the creation of new files in security-critical locations. In environments where extraction occurs with elevated privileges or targets executable paths, this may result in code execution, privilege escalation, data corruption, or denial of service.

Recommendations Update Compressing versions prior to 1.10.4 to version 1.10.4. Update Compressing version 2.0.0 to version 2.0.1.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-24884

GHSA-CC8F-XG8V-72M3

Affected Products

Compressing

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24884.json · Exploit
• https://github.com/node-modules/compressing/commit/8d16c196c7f1888fc1af957d9ff36117247cea6c · Patch
• https://github.com/node-modules/compressing/security/advisories/GHSA-cc8f-xg8v-72m3 · Vendor Advisory
• https://github.com/node-modules/compressing/commit/ce1c0131c401c071c77d5a1425bf8c88cfc16361 · Patch
• https://osv.dev/vulnerability/CVE-2026-24884 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cc8f-xg8v-72m3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24884 · Security Note
• https://github.com/node-modules/compressing · Note
• https://twitter.com/CVEnew/status/2019137041670307952 · Twitter Post
• https://twitter.com/DFIR_Radar/status/2061720086386258008 · Twitter Post
• https://t.me/CVEtracker/43746 · Telegram Post
• https://twitter.com/infoflowcloud/status/2048482444257411459 · Twitter Post
• https://t.me/cveNotify/153584 · Telegram Post
• https://twitter.com/CVEnew/status/2048481106178068566 · Twitter Post
• https://twitter.com/dailycve/status/2045281619276095983 · Twitter Post