CVE-2026-101894

Executive Summary

CVE-2026-101894 is a path traversal vulnerability (CWE-22) in the Node.js decompress package and its maintained fork @xhmikosr/decompress. The default decompress(input, output) API uses lexical containment checks that fail to account for the kernel resolving a planted symlink chain, allowing a crafted archive to read or write files outside the intended output directory. Successful exploitation can overwrite startup scripts or configuration files, leading to remote code execution; the CVSS 3.1 base score is 9.1 (Critical).

Technical Analysis

The vulnerability resides in the archive extraction logic of the Node.js decompress family of packages. Prior to @xhmikosr/decompress 10.2.2 and 11.1.4, the default decompress(input, output) API performs lexical containment checks on archive entry paths. This means the code validates that an entry's path string stays within the output directory by string comparison or normalization, rather than resolving the entry through the filesystem and confirming the final real path remains inside output.

The core flaw is a symlink-chain bypass of the kernel's own path resolution. An attacker supplies a crafted archive that contains chained symlink entries. When an earlier symlink entry is extracted, the kernel follows that link when subsequent entries are written or read. Because the lexical containment check only inspects the entry path text and not the resolved destination, a later archive entry can resolve outside the output directory. The result is arbitrary file read or write outside the intended extraction root.

This vulnerability is explicitly described as a bypass of incomplete hardening for CVE-2026-53486. That prior fix addressed an earlier iteration of the traversal problem but did not eliminate the symlink-chain vector. The bypass indicates the hardening was partial — likely focused on direct ../ path traversal without accounting for symlink resolution semantics.

The attack surface is any application or service that extracts untrusted archives using the default decompress(input, output) API with an attacker-influenced archive. This includes build pipelines, package registries, CI/CD archive handling, and any Node.js service that accepts uploaded archives.

No public proof-of-concept is available, and the precise code-level implementation of the containment check is not specified in the provided data. The mechanism above is described at the level of the vulnerability class (symlink-based path traversal / CWE-22) and the kernel path-resolution behavior described in the NVD entry.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification: The attacker identifies a target that uses the decompress or @xhmikosr/decompress package to extract untrusted archives via the default decompress(input, output) API. This could be a server accepting uploaded archives, a build system processing third-party artifacts, or a package installation flow.

2. Triggering the flaw: The attacker crafts an archive containing a chained set of symlink entries. The first symlink entry, when extracted, establishes a link pointing outside the output directory. A subsequent entry written or read through that link resolves — at the kernel level — to a location outside output. The package's lexical containment check examines only the path string and therefore does not detect that the real resolved path escaped the directory.

3. Payload/execution method: Because the resolved write path is outside output, the attacker can write files to arbitrary locations the process has permission to access. The attacker can target startup scripts or configuration files. Overwriting a startup script or configuration file is the described route to remote code execution, since the modified script or config is executed or loaded by a subsequent process start or service restart.

4. Post-exploitation impact: With arbitrary file write outside the extraction directory, the attacker achieves code execution upon execution of the overwritten startup script or loading of the modified configuration. Confidentiality and integrity impacts are both High per the CVSS vector; the described read capability also permits exfiltration of files outside output. There is no scope change (S:U), so the impact is confined to the vulnerable component's security authority.

Impact Assessment

CVSS 3.1 base score: 9.1 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

• Attack Vector (AV:N): Network — an attacker can deliver a crafted archive remotely.
• Attack Complexity (AC:L): Low — no specialized conditions beyond delivering the crafted archive to a vulnerable extraction path.
• Privileges Required (PR:N): None.
• User Interaction (UI:N): None.
• Scope (S:U): Unchanged — impact is within the vulnerable component.
• Confidentiality (C:H): High — arbitrary file read outside output.
• Integrity (I:H): High — arbitrary file write outside output, enabling startup script/config overwrite and RCE.

Business impact: Any Node.js service, build pipeline, or CI/CD system that extracts untrusted archives is at risk. The blast radius spans the confidentiality of host files readable by the extraction process and the integrity of the host's scripts and configuration, with a direct path to remote code execution via startup script or configuration overwrite.

Detection Guidance

Sigma Rule

title: Node.js decompress Symlink Chain Path Traversal (CVE-2026-101894)
id: 7c1f2b64-3a9e-4d52-9f0b-1e2a6c8d5f31
status: experimental
description: Detects extraction processes writing outside the intended output directory, consistent with symlink-chain path traversal in the Node.js decompress / @xhmikosr/decompress packages.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101894
author: valtersit.com
date: 2026-01-01
logsource:
  category: file_event
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/node'
      - '/nodejs'
  selection_path:
    TargetFilename|contains:
      - '/etc/rc'
      - '/etc/init'
      - '.bashrc'
      - '.profile'
      - '/etc/cron'
  condition: selection_proc and selection_path
falsepositives:
  - Legitimate deployment automation writing configuration during install
level: high
tags:
  - attack.t1190
  - cve.2026.101894

YARA Rule

rule CVE_2026_101894_Decompress_Symlink_Traversal
{
    meta:
        description = "Detects Node.js decompress extraction code patterns associated with symlink-chain containment bypass"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101894"
        date = "2026-01-01"
    strings:
        $api = "decompress(" ascii
        $pkg1 = "@xhmikosr/decompress" ascii
        $pkg2 = "decompress" ascii
        $sym = "symlink" ascii nocase
        $str = "output" ascii
    condition:
        ($api or $pkg1) and $sym and $str
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-101894 Node.js decompress symlink chain path traversal - archive upload"; flow:established,to_server; content:"|50 4B 03 04|"; http.request_body; content:"decompress"; http.user_agent; classtype:attempted-admin; reference:cve,2026-101894; sid:2026101894; rev:1;)

Elastic Detection

file where process.name in ("node", "nodejs") and
  file.path : ("/etc/rc*", "/etc/init*", "/etc/cron*", "*/.bashrc", "*/.profile")

Splunk SPL Query

index=main sourcetype=sysmon EventID=11
| where match(Image, "(?i)node(js)?$")
| where match(TargetFilename, "(?i)(/etc/rc|/etc/init|/etc/cron|\.bashrc|\.profile)")
| stats count by host, Image, TargetFilename
| where count > 0

Wazuh OSSEC Rule

<group name="cve-2026-101894,">
  <rule id="101894" level="12">
    <if_sid>550</if_sid>
    <field name="file">/etc/rc</field>
    <description>CVE-2026-101894: Possible Node.js decompress symlink traversal writing to startup/config path</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Do not extract untrusted archives with the default decompress(input, output) API. Perform extraction in a sandboxed, least-privilege environment.
   • Validate archive contents before extraction, rejecting symlink entries and any entry resolving outside the intended output directory.
   • Prefer resolving each entry's real path and confirming it remains within output before writing, rather than relying on lexical checks.
   • Run extraction processes under an account with no write access to startup scripts or system configuration.

2. Patch/upgrade steps:

   • There is no verified patch in tracked sources. The maintained @xhmikosr/decompress package is reported as fixed in 10.2.2 and 11.1.4; verify against the upstream advisory before relying on it.
   • The legacy decompress package is unmaintained and reported unpatched through 4.2.1. Migrate to the maintained package if a fixed version can be confirmed, or replace the dependency.

3. Long-term hardening:

   • Adopt defense-in-depth for archive handling: symlink-aware path resolution, extraction allowlists, and immutable output roots.
   • Monitor for follow-on writes to startup scripts and configuration files by extraction processes.
   • Track CVE-2026-53486 hardening and its bypasses to ensure traversal mitigations remain complete.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-101894
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CVE-2026-53486 (prior hardening this vulnerability bypasses): https://nvd.nist.gov/vuln/detail/CVE-2026-53486
• FIRST EPSS: Not yet scored by FIRST.org (no EPSS value available).

No threat actor campaigns or exploit-in-the-wild evidence are available for this CVE at this time. CISA KEV: NO. No public PoC, exploit code, or Nuclei template is available.