Symbolic Link Vulnerability in Compressing Library by Node Modules

CVE-2026-24884

What is CVE-2026-24884?

The Compressing library for Node has a vulnerability where it extracts TAR archives while improperly handling symbolic links. This flaw allows attackers to create symlinks that resolve outside the intended extraction directory, potentially leading to the arbitrary writing of files in sensitive locations on the host file system. If not addressed, this could enable the overwrite of existing files or the creation of new files in areas that may jeopardize system integrity. The issue has been resolved in versions 1.10.4 and 2.0.1.

References