[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-39243":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":195,"aliases":205,"duplicate_of":9,"upstream":207,"downstream":208,"duplicates":211,"related":212,"reserved_at":9,"published_at":213,"modified_at":214,"state":215,"summary":216,"references_raw":224,"kevs":249,"epss":250,"epss_history":253,"metrics":471,"affected":481},"CVE-2026-39243","decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-59","Improper Link Resolution Before File Access ('Link Following')","The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.","weakness","Draft","Base","Medium",[20,101,162,191],{"id":21,"name":22,"techniques":23},"CAPEC-132","Symlink Attack",[24],{"id":25,"name":26,"tactics":27,"countermeasures":34},"T1547.009","Shortcut Modification",[28,31],{"id":29,"name":30},"TA0110","Persistence",{"id":32,"name":33},"TA0111","Privilege Escalation",[35,40,45,49,53,57,62,67,71,75,80,84,88,92,96],{"id":36,"name":37,"tactic":38},"D3-LFP","Local File Permissions",{"name":39},"Isolate",{"id":41,"name":42,"tactic":43},"D3-DA","Dynamic Analysis",{"name":44},"Detect",{"id":46,"name":47,"tactic":48},"D3-FIM","File Integrity Monitoring",{"name":44},{"id":50,"name":51,"tactic":52},"D3-EFA","Emulated File Analysis",{"name":44},{"id":54,"name":55,"tactic":56},"D3-CM","Content Modification",{"name":39},{"id":58,"name":59,"tactic":60},"D3-FEV","File Eviction",{"name":61},"Evict",{"id":63,"name":64,"tactic":65},"D3-DF","Decoy File",{"name":66},"Deceive",{"id":68,"name":69,"tactic":70},"D3-FA","File Analysis",{"name":44},{"id":72,"name":73,"tactic":74},"D3-CF","Content Filtering",{"name":39},{"id":76,"name":77,"tactic":78},"D3-FE","File Encryption",{"name":79},"Harden",{"id":81,"name":82,"tactic":83},"D3-EAL","Executable Allowlisting",{"name":39},{"id":85,"name":86,"tactic":87},"D3-EDL","Executable Denylisting",{"name":39},{"id":89,"name":90,"tactic":91},"D3-RFAM","Remote File Access Mediation",{"name":39},{"id":93,"name":94,"tactic":95},"D3-CQ","Content Quarantine",{"name":39},{"id":97,"name":98,"tactic":99},"D3-RF","Restore File",{"name":100},"Restore",{"id":102,"name":103,"techniques":104},"CAPEC-17","Using Malicious Files",[105,142],{"id":106,"name":107,"tactics":108,"countermeasures":120},"T1574.005","Executable Installer File Permissions Weakness",[109,110,111,114,117],{"id":29,"name":30},{"id":32,"name":33},{"id":112,"name":113},"TA0030","Defense Evasion",{"id":115,"name":116},"TA0005","Stealth",{"id":118,"name":119},"TA0104","Execution",[121,125,129,134,138],{"id":122,"name":123,"tactic":124},"D3-SU","Software Update",{"name":79},{"id":126,"name":127,"tactic":128},"D3-RS","Restore Software",{"name":100},{"id":130,"name":131,"tactic":132},"D3-AVE","Asset Vulnerability Enumeration",{"name":133},"Model",{"id":135,"name":136,"tactic":137},"D3-SWI","Software Inventory",{"name":133},{"id":139,"name":140,"tactic":141},"D3-SBV","Service Binary Verification",{"name":44},{"id":143,"name":144,"tactics":145,"countermeasures":151},"T1574.010","Services File Permissions Weakness",[146,147,148,149,150],{"id":29,"name":30},{"id":32,"name":33},{"id":112,"name":113},{"id":115,"name":116},{"id":118,"name":119},[152,154,156,158,160],{"id":126,"name":127,"tactic":153},{"name":100},{"id":135,"name":136,"tactic":155},{"name":133},{"id":139,"name":140,"tactic":157},{"name":44},{"id":130,"name":131,"tactic":159},{"name":133},{"id":122,"name":123,"tactic":161},{"name":79},{"id":163,"name":164,"techniques":165},"CAPEC-35","Leverage Executable Code in Non-Executable Files",[166,173,180],{"id":167,"name":168,"tactics":169,"countermeasures":172},"T1027.006","HTML Smuggling",[170,171],{"id":112,"name":113},{"id":115,"name":116},[],{"id":174,"name":175,"tactics":176,"countermeasures":179},"T1027.009","Embedded Payloads",[177,178],{"id":112,"name":113},{"id":115,"name":116},[],{"id":181,"name":182,"tactics":183,"countermeasures":186},"T1564.009","Resource Forking",[184,185],{"id":112,"name":113},{"id":115,"name":116},[187],{"id":188,"name":189,"tactic":190},"D3-FFV","File Format Verification",{"name":39},{"id":192,"name":193,"techniques":194},"CAPEC-76","Manipulating Web Input to File System Calls",[],[196],{"_key":197,"name":198,"source":199,"url":200,"maturity":201,"reliability_score":202,"verified":203,"type":9,"platforms":204,"requires_auth":9,"exploitdb":9,"metasploit":9},"GITHUB_KEVVA_DECOMPRESS","Decompress","github","https://github.com/kevva/decompress/issues/71","poc",0.3,false,[],[206],"GHSA-jwp9-9v96-94mx",[],[209],{"_key":210},"RHSA-2026:37577",[],[],"2026-07-09T00:00:00.000Z","2026-07-10T15:25:09.237Z","Analyzed",{"cisa_kev":203,"cisa_ransomware":203,"cisa_vendor":9,"epss_severity":217,"epss_score":218,"severity":219,"severity_score":220,"severity_version":221,"severity_source":222,"severity_vector":223,"severity_status":215},"low",0.00301,"medium",5.5,"v3.1","cve.org","CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",[225,233,238,244],{"url":226,"sources":227,"tags":230},"https://github.com/kevva/decompress",[222,228,229],"nvd","osv_npm",[231,232],"Product","PACKAGE",{"url":234,"sources":235,"tags":236},"https://www.npmjs.com/package/decompress",[222,228,229],[231,237],"WEB",{"url":239,"sources":240,"tags":241},"https://github.com/kevva/decompress/issues/113",[222,228,229],[242,243,237],"Exploit","Vendor Advisory",{"url":245,"sources":246,"tags":247},"https://nvd.nist.gov/vuln/detail/CVE-2026-39243",[229],[248],"Advisory",[],{"date":251,"score":218,"percentile":252},"2026-09-19",0.23045,[254,258,262,265,268,272,275,278,281,284,287,290,293,296,299,303,306,309,312,315,318,321,324,327,330,333,336,339,342,345,347,350,353,356,359,362,365,368,371,374,377,380,383,386,389,392,395,398,401,404,407,410,413,416,419,422,425,428,431,434,437,440,443,446,449,452,455,458,461,464,467,470],{"date":255,"score":256,"percentile":257},"2026-07-10",0.0017,0.06617,{"date":259,"score":260,"percentile":261},"2026-07-11",0.00196,0.09439,{"date":263,"score":260,"percentile":264},"2026-07-12",0.09431,{"date":266,"score":260,"percentile":267},"2026-07-13",0.09422,{"date":269,"score":270,"percentile":271},"2026-07-14",0.00248,0.16038,{"date":273,"score":270,"percentile":274},"2026-07-15",0.16054,{"date":276,"score":270,"percentile":277},"2026-07-16",0.16068,{"date":279,"score":270,"percentile":280},"2026-07-17",0.16076,{"date":282,"score":270,"percentile":283},"2026-07-18",0.16083,{"date":285,"score":270,"percentile":286},"2026-07-19",0.16077,{"date":288,"score":270,"percentile":289},"2026-07-20",0.16179,{"date":291,"score":270,"percentile":292},"2026-07-21",0.16173,{"date":294,"score":270,"percentile":295},"2026-07-22",0.16233,{"date":297,"score":270,"percentile":298},"2026-07-23",0.16213,{"date":300,"score":301,"percentile":302},"2026-07-24",0.00328,0.25217,{"date":304,"score":301,"percentile":305},"2026-07-25",0.25307,{"date":307,"score":301,"percentile":308},"2026-07-26",0.25295,{"date":310,"score":301,"percentile":311},"2026-07-27",0.25274,{"date":313,"score":301,"percentile":314},"2026-07-28",0.25337,{"date":316,"score":301,"percentile":317},"2026-07-29",0.25343,{"date":319,"score":301,"percentile":320},"2026-07-30",0.25392,{"date":322,"score":301,"percentile":323},"2026-07-31",0.25396,{"date":325,"score":301,"percentile":326},"2026-08-01",0.25403,{"date":328,"score":301,"percentile":329},"2026-08-02",0.25404,{"date":331,"score":301,"percentile":332},"2026-08-03",0.25416,{"date":334,"score":301,"percentile":335},"2026-08-04",0.25374,{"date":337,"score":301,"percentile":338},"2026-08-05",0.25323,{"date":340,"score":301,"percentile":341},"2026-08-06",0.25357,{"date":343,"score":301,"percentile":344},"2026-08-07",0.25388,{"date":346,"score":301,"percentile":320},"2026-08-08",{"date":348,"score":301,"percentile":349},"2026-08-09",0.25382,{"date":351,"score":301,"percentile":352},"2026-08-10",0.25394,{"date":354,"score":301,"percentile":355},"2026-08-11",0.25487,{"date":357,"score":301,"percentile":358},"2026-08-12",0.25553,{"date":360,"score":301,"percentile":361},"2026-08-13",0.25582,{"date":363,"score":301,"percentile":364},"2026-08-14",0.25619,{"date":366,"score":301,"percentile":367},"2026-08-15",0.25761,{"date":369,"score":301,"percentile":370},"2026-08-16",0.25789,{"date":372,"score":301,"percentile":373},"2026-08-17",0.25694,{"date":375,"score":301,"percentile":376},"2026-08-18",0.25715,{"date":378,"score":301,"percentile":379},"2026-08-19",0.25837,{"date":381,"score":301,"percentile":382},"2026-08-20",0.25887,{"date":384,"score":301,"percentile":385},"2026-08-21",0.25924,{"date":387,"score":301,"percentile":388},"2026-08-22",0.25936,{"date":390,"score":301,"percentile":391},"2026-08-23",0.25879,{"date":393,"score":218,"percentile":394},"2026-08-24",0.22143,{"date":396,"score":218,"percentile":397},"2026-08-25",0.22159,{"date":399,"score":218,"percentile":400},"2026-08-26",0.2223,{"date":402,"score":218,"percentile":403},"2026-08-27",0.22235,{"date":405,"score":218,"percentile":406},"2026-08-28",0.22239,{"date":408,"score":218,"percentile":409},"2026-08-29",0.22265,{"date":411,"score":218,"percentile":412},"2026-08-30",0.22307,{"date":414,"score":218,"percentile":415},"2026-08-31",0.22286,{"date":417,"score":218,"percentile":418},"2026-09-01",0.22311,{"date":420,"score":218,"percentile":421},"2026-09-02",0.22336,{"date":423,"score":218,"percentile":424},"2026-09-03",0.22355,{"date":426,"score":218,"percentile":427},"2026-09-04",0.22384,{"date":429,"score":218,"percentile":430},"2026-09-05",0.22405,{"date":432,"score":218,"percentile":433},"2026-09-06",0.22452,{"date":435,"score":218,"percentile":436},"2026-09-07",0.22453,{"date":438,"score":218,"percentile":439},"2026-09-08",0.22465,{"date":441,"score":218,"percentile":442},"2026-09-09",0.22589,{"date":444,"score":218,"percentile":445},"2026-09-10",0.22596,{"date":447,"score":218,"percentile":448},"2026-09-11",0.22584,{"date":450,"score":218,"percentile":451},"2026-09-12",0.2269,{"date":453,"score":218,"percentile":454},"2026-09-13",0.2265,{"date":456,"score":218,"percentile":457},"2026-09-14",0.22669,{"date":459,"score":218,"percentile":460},"2026-09-15",0.22743,{"date":462,"score":218,"percentile":463},"2026-09-16",0.22835,{"date":465,"score":218,"percentile":466},"2026-09-17",0.2289,{"date":468,"score":218,"percentile":469},"2026-09-18",0.23036,{"date":251,"score":218,"percentile":252},[472,477,479],{"source":222,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":473,"cvss_v4_0":9},{"baseScore":220,"baseSeverity":474,"vectorString":223,"impactScore":475,"exploitabilityScore":476},"MEDIUM",6,4.6,{"source":228,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":478,"cvss_v4_0":9},{"baseScore":220,"baseSeverity":474,"vectorString":223,"impactScore":475,"exploitabilityScore":476},{"source":229,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":480,"cvss_v4_0":9},{"baseScore":220,"baseSeverity":9,"vectorString":223,"impactScore":475,"exploitabilityScore":476},[482,493],{"ecosystem":9,"name":483,"vendor":484,"product":483,"cpe_part":485,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":486},"decompress","decompress_project","a",[487],{"version":488,"is_range":489,"range_type":490,"version_start":9,"version_start_type":9,"version_end":491,"version_end_type":492,"fixed_in":9},"lte4.2.1",true,"cpe","4.2.1","including",{"ecosystem":494,"name":483,"vendor":494,"product":483,"cpe_part":9,"purl_type":495,"purl_namespace":9,"purl_name":483,"source":9,"versions":496},"Npm","npm",[497],{"version":498,"is_range":489,"range_type":499,"version_start":9,"version_start_type":9,"version_end":491,"version_end_type":492,"fixed_in":9},"lte4_2_1","semver"]