CVE-2026-24884

The record

Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor’s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1.

Affected packages

Related vulnerabilities

• GHSA-cc8f-xg8v-72m3 Compressing Vulnerable to Arbitrary File Write via Symlink Extraction Same vulnerability
• CVE-2026-40931 Compressing is a compressing and uncompressing lib for node. Also affects compressing
• GHSA-4c3q-x735-j3r5 Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing Also affects compressing
• CVE-2026-113724 virtualenv is a tool for creating isolated virtual python environments. CWE-59
• CVE-2026-113716 virtualenv is a tool for creating isolated virtual python environments. CWE-59
• CVE-2026-55480 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-59
• CVE-2026-90954 A flaw was found in BusyBox's dpkg-deb archive extraction. CWE-59
• CVE-2026-109274 ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race… CWE-59