Topic starter
25/10/2026 11:04 am
TL;DR: 11.1.4 and 10.2.2 mark the safe releases Safe Security’s case work used to show that CVE-2026-101894 can drive outside writes in @xhmikosr/decompress. Archive extraction needs stricter boundary handling because lexical checks can fail once symlink resolution and file writes interleave.
Editorial analysis by NHI Mgmt Group, based on content published by Safe Security: “CVE-2026-101894: Symlink-Chain Path Traversal in @xhmikosr/decompress”.
By the numbers:
- CVE-2026-101894 is rated critical with a CVSS v3.1 score of 9.1 / 10.
- The vulnerability affects @xhmikosr/decompress 11.0.0 through 11.1.3 and 10.2.1 and earlier.
- The supplied 300-attempt sessions recorded 19 outside writes on 11.1.3 and 20 on 10.2.1.
Key questions
Q: Why do archive path traversal bugs create such high operational risk?
A: They can change host state during ordinary automation, including overwriting files, planting directories, or preparing later execution paths.
Q: What are the signs that archive containment checks are failing?
A: Look for extraction results that vary across repeated runs, especially when the same archive sometimes stays inside the target tree and sometimes creates outside files or directories.
Q: What breaks when archive extraction trusts symlink chains inside untrusted files?
A: The extractor can write outside the intended destination because the path that looks safe lexically may resolve to a different place once the filesystem follows planted links.
Practitioner guidance
- Harden archive extraction boundaries Run untrusted archive extraction in a dedicated process with the smallest possible filesystem view and no direct access to sensitive host paths.
- Reject link-based archive escapes Validate symlink and hardlink targets against the real destination tree before any file write is committed, not after extraction returns.
- Restrict service-account write scope Limit the credentials and filesystem permissions used by build agents and deployment workers so a single archive cannot overwrite arbitrary host files.
Bottom line: The core issue is not simple path parsing but a filesystem boundary failure that lets crafted archive entries escape the intended directory.
Glossary terms: Path Traversal, Symlink Chain, Extraction-Time Write, Filesystem Boundary Validation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Archive extraction is a governance problem when automation trusts filesystem paths. The article shows that a routine utility can become a boundary-breaking write primitive when a workflow extracts attacker-controlled content without controlling link resolution. That matters for CI/CD jobs, deployment agents, and any service that treats archive contents as implicitly safe. Practitioners should treat extraction boundaries as a policy control, not a convenience setting.
A question worth separating out:
Q: How should teams isolate archive processing from broader host access?
A: Use a low-privilege process, limit the filesystem namespace it can see, and make sure the extraction account cannot reach paths outside the intended staging area. The goal is to prevent a single malformed archive from turning into host-level tampering. Isolation does not fix the flaw, but it sharply reduces the blast radius.
👉 Read our full editorial: Symlink-chain path traversal in decompress exposes archive escapes
This post was modified 7 days ago by NHI Mgmt Group