CVE-2026-10732: Decompress Package Zip Slip RCE Vulnerability

CVE-2026-10732 Overview

CVE-2026-10732 is an arbitrary file write vulnerability affecting all versions of the decompress npm package. The flaw enables Zip Slip exploitation through a race-like ordering bug in symlink handling during ZIP archive extraction. Attackers craft a ZIP archive containing two entries with the same path: a symlink pointing to an arbitrary target, followed by a regular file. The microtask processing order causes readlink for the second entry to execute before symlink resolution completes for the first, writing file content through the symlink to a location outside the output directory. The vulnerability bypasses the preventWritingThroughSymlink protection introduced as a fix for CVE-2020-12265.

Critical Impact
Successful exploitation enables arbitrary file write on the host filesystem, which can escalate to remote code execution when attacker-controlled content overwrites executable scripts, configuration files, or startup hooks.

Affected Products

decompress npm package — all versions
Node.js applications and tooling that extract untrusted ZIP archives using decompress
Build pipelines and CI/CD systems that consume third-party archives through decompress

Discovery Timeline

2026-06-05 - CVE-2026-10732 published to NVD
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-10732

Vulnerability Analysis

The vulnerability is classified under [CWE-29] (Path Traversal: \..\filename) and operates as a symlink-based archive extraction attack. The decompress package processes ZIP entries asynchronously, scheduling filesystem operations through JavaScript microtasks. When two archive entries share the same target path, the package attempts to validate the second entry with readlink before the symlink created by the first entry has been fully resolved by the protection logic. The result is that the write operation for the regular file follows the symlink to its target instead of being blocked.

Because the destination is fully attacker-controlled through the symlink target, the resulting write can land anywhere the extracting process has permission to write. This makes the issue functionally equivalent to an arbitrary file write primitive, often a stepping stone to remote code execution.

Root Cause

The root cause is an ordering defect in asynchronous extraction logic. The preventWritingThroughSymlink check, added to remediate CVE-2020-12265, assumes symlinks from earlier entries are fully materialized before later entries are validated. The microtask scheduler does not guarantee this ordering, so the guard evaluates state that has not yet been updated.

Attack Vector

Exploitation requires an application to extract an attacker-supplied ZIP archive using decompress. The attacker constructs an archive with duplicate path entries: a symlink entry pointing outside the extraction root, immediately followed by a regular file entry at the same archive path. User interaction is typically required, such as uploading or downloading the malicious archive. Detailed proof-of-concept material is available in the GitHub Gist PoC and the Snyk Vulnerability Report.

Detection Methods for CVE-2026-10732

Indicators of Compromise

Files written outside the intended extraction directory immediately after a decompress invocation in process logs.
ZIP archives containing duplicate path entries where one entry is a symlink and the other is a regular file.
Unexpected modifications to sensitive paths such as ~/.ssh/authorized_keys, ~/.npmrc, systemd units, or shell profile files following archive processing.

Detection Strategies

Statically scan package.json and lockfiles across repositories for any direct or transitive dependency on decompress.
Inspect uploaded ZIP archives for symlink entries (0xA1FF external attributes) combined with duplicate filename entries before extraction.
Monitor for file writes performed by Node.js processes to paths outside their working directory or extraction targets.

Monitoring Recommendations

Enable filesystem audit rules on sensitive directories that build agents and Node.js services touch during archive processing.
Alert on creation of symbolic links by service accounts that do not normally generate them.
Track outbound writes from CI/CD runners that consume third-party archives and correlate them with decompress invocations.

How to Mitigate CVE-2026-10732

Immediate Actions Required

Inventory all applications and pipelines depending on decompress directly or transitively.
Replace decompress with a maintained alternative such as adm-zip, yauzl, or node-stream-zip that validates entry paths and symlink targets synchronously.
Reject archives that contain symbolic links or duplicate path entries when extracting untrusted input.

Patch Information

No fixed version of decompress is identified in the published advisory. Refer to the GitHub Pull Request Discussion and the Snyk Vulnerability Report for current remediation status.

Workarounds

Pre-validate archives by iterating entries and rejecting any symlink or duplicate path before calling decompress.
Run extraction inside an unprivileged container or chroot so a successful escape cannot reach sensitive host paths.
Set restrictive umask and run the extracting process as a low-privilege user that cannot write to system or user configuration locations.

bash

# Example pre-extraction check using unzip to list entries
unzip -l untrusted.zip | awk '{print $4}' | sort | uniq -d
# Any duplicate path output should cause the archive to be rejected