CVE-2026-39243 decompress allows arbitrary hardlink creation during archive extraction
Attackers can create arbitrary hardlinks during archive extraction to read or overwrite files on the same filesystem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-39243?
CVE-2026-39243 is a medium-severity path traversal vulnerability in n/a, published on 9 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.
Weakness: CWE-59
Which versions are affected by CVE-2026-39243?
2 open source packages ship an affected version, including decompress. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
decompress npm | All versions to 4.2.1 | None |
decompress npm | All versions to 4.2.1 | None |
Products include Decompress Project Decompress.
How do I fix CVE-2026-39243?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-39243 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39243 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jwp9-9v96-94mx, MINI-7m5j-mr6h-mjjm, MINI-pqvv-vqxg-252f, MINI-v964-8pvp-fh27.