GHSA-qgfr-5hqp-vrw9
Path Traversal in decompress
At a glance
- Published
- Updated
- CVE
- CVE-2020-12265
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Versions of `decompress` prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing`../`. ## Recommendation Upgrade to version 4.2.1 or later.
Affected packages
| Package | Versions |
|---|---|
| npm · decompress | introduced 0, fixed 4.2.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-12265 ADVISORY
- https://github.com/kevva/decompress/issues/71 WEB
- https://github.com/kevva/decompress/pull/73 WEB
- https://github.com/kevva/decompress/commit/967146e70f48be32ed1a69daa3941d681944d513 WEB
- https://github.com/kevva/decompress PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |