CVE-2026-24884: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24884 is an arbitrary file write vulnerability via symlink traversal in the compressing npm package (node-modules/compressing). The library extracts TAR archives while restoring symbolic links without validating their targets, allowing an attacker who supplies a crafted TAR archive to write files outside the intended extraction directory. Affected versions are all 1.x releases up to and including 1.10.3, and version 2.0.0. The vulnerability was disclosed on February 3, 2026, with patches released as versions 1.10.4 and 2.0.1. It carries a CVSS v3.1 base score of 8.4 (High) (Github Advisory).

The root cause is classified as CWE-59 (Improper Link Resolution Before File Access / 'Link Following'). The compressing.tar.uncompress function sanitizes destination paths for regular archive entries but does not validate the targets of symbolic links embedded in TAR archives. During extraction, the library creates symlinks inside the output directory without checking whether their targets resolve outside the extraction root; subsequent file entries that traverse through these symlinks are then written to the symlink's target location rather than the intended extraction directory. A proof-of-concept published in the security advisory demonstrates the attack by embedding a symlink (e.g., myTmp -> /tmp) followed by a file entry (myTmp/poc.txt), resulting in poc.txt being written to /tmp/poc.txt (Github Advisory, Patch Commit). The fix introduces an isPathWithinParent() validation function that resolves and checks both entry paths and symlink targets against the destination directory before allowing extraction to proceed.

Successful exploitation allows an attacker to write arbitrary files to any location on the host file system accessible to the process performing the extraction. In environments where TAR extraction runs with elevated privileges (e.g., as root or a privileged service account), this can lead to overwriting sensitive system files (such as /etc/passwd or SSH authorized keys), planting malicious executables in system paths, privilege escalation, data corruption, or denial of service. The confidentiality, integrity, and availability impacts are all rated High, as an attacker can read sensitive files via symlink creation, overwrite critical files, and disrupt system operation (Github Advisory).

A proof-of-concept exploit is publicly available in the GitHub security advisory, demonstrating the attack with a crafted TAR archive containing a malicious symlink followed by a file entry (Github Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.011% (1st percentile), indicating a low current probability of active exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction in the sense that a victim application must process a crafted TAR archive supplied by the attacker, but no privileges are required on the attacker's part.

1. Craft a malicious TAR archive: Using Python's tarfile module or a similar tool, construct a TAR archive containing: (a) a regular file entry (e.g., archive/baseFile.txt), (b) a symlink entry (e.g., archive/myTmp) pointing to an attacker-controlled absolute path outside the extraction directory (e.g., /tmp or /etc), and (c) a subsequent regular file entry whose path traverses through the symlink (e.g., archive/myTmp/poc.txt with malicious content).
2. Deliver the archive: Supply the crafted TAR file to a Node.js application that uses the vulnerable compressing npm package (versions ≤ 1.10.3 or = 2.0.0) to extract user-supplied or remotely fetched archives.
3. Trigger extraction: Cause the application to call compressing.tar.uncompress(archivePath, destPath) on the malicious archive. The library will create the symlink inside the output directory without validating its target.
4. Achieve arbitrary file write: When the library processes the subsequent file entry (archive/myTmp/poc.txt), it resolves the path through the symlink and writes the file to the symlink's target (e.g., /tmp/poc.txt). If the process runs with elevated privileges, the attacker can target security-critical paths such as cron directories, SSH configuration, or system binaries to achieve code execution or privilege escalation (Github Advisory).

• File System: Unexpected files appearing in directories outside the intended extraction path (e.g., /tmp/, /etc/, /root/, or other system directories) shortly after a TAR extraction operation; symbolic links within the extraction output directory pointing to locations outside the extraction root.
• Logs: Node.js application logs containing [compressing] Skipping symlink or [compressing] Skipping entry with path traversal warning messages (only present after patching — absence of these warnings on a patched system may indicate a bypass attempt); application error logs showing unexpected file write operations to system paths.
• Process: Node.js processes writing files to sensitive system directories (e.g., /etc/, /root/.ssh/, /usr/local/bin/) during or immediately after archive extraction operations.
• Network: Inbound delivery of TAR or TGZ archives from untrusted or unexpected sources to services that perform automatic extraction using the compressing library.

Upgrade the compressing npm package to version 1.10.4 (for the 1.x branch) or 2.0.1 (for the 2.x branch), which add isPathWithinParent() validation to block symlink targets and entry paths that escape the extraction directory (Github Advisory, Patch Commit). If immediate patching is not possible, implement application-level validation to inspect TAR archive contents for symlinks with external targets before passing archives to compressing for extraction. Additionally, run extraction processes with the least privilege necessary and avoid extracting archives from untrusted sources in environments with elevated privileges.

The vulnerability was reported by security researcher Heeqw and published by maintainer fengmk2 on February 3, 2026 (Github Advisory). A subsequent related CVE (CVE-2026-40931) was disclosed, described as a patch bypass for CVE-2026-24884, attracting coverage from outlets including Undercode News and InfoSec Writeups, with a detailed write-up titled "Uncovering the Blind Spot: Bypassing a Security Patch (CVE-2026-24884) to Achieve Arbitrary File Write" published on InfoSec Writeups. Social media discussion was noted on Mastodon and Bluesky via TheHackerWire, and the vulnerability was covered by CyberPress.