GHSA-cc8f-xg8v-72m3
High · 8.4CVSS
8.4
EPSS
—
Published
Feb 3, 2026
CISA due date
—
The record
Compressing Vulnerable to Arbitrary File Write via Symlink Extraction
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | compressing | 0 | 1.10.4 |
| npm | compressing | 2.0.0 | 2.0.1 |
Related vulnerabilities
- CVE-2026-24884 Compressing is a compressing and uncompressing lib for node. Same vulnerability
- CVE-2026-40931 Compressing is a compressing and uncompressing lib for node. Also affects compressing
- GHSA-4c3q-x735-j3r5 Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing Also affects compressing
- CVE-2026-113724 virtualenv is a tool for creating isolated virtual python environments. CWE-59
- CVE-2026-113716 virtualenv is a tool for creating isolated virtual python environments. CWE-59
- CVE-2026-55480 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-59
- CVE-2026-90954 A flaw was found in BusyBox's dpkg-deb archive extraction. CWE-59
- CVE-2026-109274 ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race… CWE-59