An arbitrary symlink creation vulnerability in the decompress package before version 4.2.2 allows unauthenticated attackers to write malicious symlinks during archive extraction, leading to potential data exposure and system compromise.

This is an improper validation vulnerability located in the archive extraction logic of the decompress package, where symlink entries fail to undergo necessary path validation before being passed to fs.symlink(). An unauthenticated attacker can exploit this via a crafted archive over the network with no user interaction required.

A successful exploit permits an attacker to direct symlinks toward sensitive files outside the intended extraction directory, such as system configuration files. When the application subsequently reads these extracted references, it can result in unauthorized information disclosure and loss of data confidentiality. The CVSS score of 7.5 reflects a high severity threat due to the network vector and lack of required privileges.

Immediate Action: Update the decompress package to version 4.2.2 or later immediately to incorporate the necessary symlink validation checks.

Proactive Monitoring: Monitor application error logs and file system activity for anomalous archive extraction processes or unexpected symlink generation within storage directories.

Compensating Controls: Implement strict input validation on all uploaded archive files and restrict application execution permissions to isolate potential directory traversal attempts.

Public Exploit Available: No — there is no confirmed public exploit or weaponized module available in standard repositories.

Organizations utilizing the decompress library must treat this high severity flaw with urgency. Apply the recommended package update to version 4.2.2 promptly to prevent unauthorized file system interactions and maintain application integrity.