Arbitrary File Write Vulnerability in Decompress Package by Snyk

CVE-2026-10732

What is CVE-2026-10732?

The Decompress package is susceptible to an Arbitrary File Write vulnerability, commonly termed Zip Slip, which occurs during the extraction of ZIP archives. This issue arises when a ZIP file contains two entries with identical paths: the first entry is a symlink directing to an arbitrary target, while the second is a regular file. As a result, an attacker is capable of writing files to locations outside the intended output directory by exploiting the way the package processes microtasks. This vulnerability enables potential remote code execution by allowing the attacker to craft a malicious ZIP archive that, when extracted, places files in unauthorized locations on the file system. Furthermore, this issue circumvents existing path traversal safeguards, including those established to mitigate similar vulnerabilities.

References