CVE-2026-24884 Compressing Vulnerable to Arbitrary File Write via Symlink Extraction
Attackers can write arbitrary files to the host filesystem via malicious symlinks in TAR archives, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24884?
CVE-2026-24884 is a high-severity path traversal vulnerability in node-modules compressing, published on 4 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor’s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1.
Weakness: CWE-59
Which versions are affected by CVE-2026-24884?
4 open source packages ship an affected version, including compressing. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
compressing npm | All versions | 1.10.4 |
compressing npm | All versions | 1.10.4 |
compressing npm | From 2.0.0 | 2.0.1 |
compressing npm | From 2.0.0 | 2.0.1 |
Products include Node-Modules Compressing.
How do I fix CVE-2026-24884?
Upgrade compressing to a fixed version for your release line: 1.10.4 or 2.0.1.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-24884 being exploited?
There is no known exploitation of CVE-2026-24884 in the wild and no public exploit code.
Other vulnerabilities in node-modules compressing
Sources
Also known as GHSA-cc8f-xg8v-72m3.