Description
The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.
Remediation
References
https://github.com/kevva/decompress/issues/71
https://github.com/kevva/decompress/pull/73
https://www.npmjs.com/advisories/1217
Related Vulnerabilities
CVE-2021-43787 Vulnerability in npm package nodebb
CVE-2022-22965 Vulnerability in maven package org.springframework.boot:spring-boot-starter-webflux
CVE-2020-5497 Vulnerability in maven package org.mitre:openid-connect-common
CVE-2016-2510 Vulnerability in maven package org.beanshell:bsh
CVE-2021-21639 Vulnerability in maven package org.jenkins-ci.main:jenkins-core