sharpcompress
SharpCompress is a compression library for NET 4.8/NET Standard 2.0/NET Standard 2.1/NET 5.0/NET 6.0/NET 7.0/NET 8.0/NET 9.0/NET 10.0 that can unrar, decompress 7zip, decompress xz, zip/unzip, tar/untar lzip/unlzip, bzip2/unbzip2 and gzip/ungzip with forward-only reading and file random access APIs. Write support for zip/tar/bzip2/gzip/7zip is implemented.
72%
Total Score
caution
Usable with caveats: maintenance is active, but most recent commits come from one contributor.
Health Score Breakdown
Six contributors were active recently, but one contributor made about 84% of commits. That concentration leaves meaningful continuity risk despite the broader contributor set.
The repository has no published security policy. This reduces transparency for reporting vulnerabilities, although active development and dependency monitoring partly compensate.
Both workflows use read-only permissions and the audit found no high- or medium-severity issues, but all six action references are unpinned. That creates avoidable build-reproducibility and action-update risk.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-176842 SharpCompress is vulnerable to Path Traversal in versions 0.0.1 - 0.50.3. | 0.0.1 - 0.50.3 | Medium |
AIKIDO-2026-10799 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. SharpCompress is vulnerable to Denial of Service (DoS) in versions 0.10.0 - 0.37.0. | 0.10.0 - 0.37.0 | Medium |
AIKIDO-2026-10798 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. SharpCompress is vulnerable to Denial of Service (DoS) in versions 0.10.0 - 0.34.2. | 0.10.0 - 0.34.2 | Medium |
CVE-2026-44788 SharpCompress is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 0.48.0. | 0.0.0 - 0.48.0 | Medium |
AIKIDO-2025-10875 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. SharpCompress is vulnerable to Denial of Service (DoS) in versions 0.1.0 - 0.41.0. | 0.1.0 - 0.41.0 | Low |
Package versions
Maintainers
No maintainer information available.
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 microsoft.bcl.asyncinterfaces Version [8.0.0, ) | — | — |
system.text.encoding.codepages Version [8.0.0, ) | — | — |
Weekly Downloads
Info
- Last Published
- 2 months ago
- Created
- 15 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.