AIKIDO-2026-398140
compressing is vulnerable to Path Traversal
53
Medium Risk
This Affects:
compressingTL;DR
The archive extraction in compressing validates each entry's destination with a recursive symlink walk in lib/utils.js before writing extracted files. The dangling-symlink branch of that check inspects only the first hop of a symlink chain, so a pre-existing multi-hop chain whose first hop stays inside the extraction root while a later hop points outside is treated as safe. Extracting a crafted tar, tgz, or zip archive into a directory seeded with such a chain then creates attacker-controlled files outside the extraction root. The fix fully resolves and validates every hop of the chain, removes destination symlinks, and opens targets with O_NOFOLLOW where available.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and extract archives into a directory whose contents can be influenced by untrusted input.
Background info
compressing is vulnerable to Path Traversal in versions 0.0.1 - 1.10.5 and 2.0.0 - 2.1.1.
How to fix this
Upgrade the compressing library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant