GCVE - cpe:2.3:a:decompress_project:decompress:*:*:*:*:*:node.js:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:decompress_project:decompress:*:*:*:*:*:node.js:*:*

part: a version: * update: *

Vendor	Decompress Project (`0e756591-d108-5c1f-9f1b-e9ca7e18c033`)
Product	Decompress (`ed370b58-eff9-50a9-a471-30d9342ea6d4`)
Edition	*
Language	*
Software edition	*
Target software	node.js
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-12265`	vulnerable	2026-06-08 05:17:56.762237	Details available The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal. Published: 2020-04-26T16:46:21.000Z Updated: 2024-08-04T11:48:58.593Z Open on db.gcve.eu Reference links https://www.npmjs.com/advisories/1217 https://github.com/kevva/decompress/issues/71 https://github.com/kevva/decompress/pull/73	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.