CVE-2026-40931

{
  "id": "CVE-2026-40931",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-21T22:16:19.247",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this \"Logical vs. Physical\" divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbolic links). This vulnerability is fixed in 2.1.1 and 1.10.5."
    },
    {
      "lang": "es",
      "value": "Compressing es una librería de compresión y descompresión para Node. Antes de las versiones 2.1.1 y 1.10.5, el parche para CVE-2026-24884 se basa en una validación de cadena puramente lógica dentro de la utilidad isPathWithinParent. Esta comprobación verifica si una cadena de ruta resuelta comienza con la cadena del directorio de destino, pero no tiene en cuenta el estado real del sistema de archivos. Al explotar esta divergencia ’Lógico vs. Físico’, un atacante puede eludir la comprobación de seguridad utilizando una técnica de Envenenamiento de Directorios (enlaces simbólicos preexistentes). Esta vulnerabilidad está corregida en las versiones 2.1.1 y 1.10.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "node-modules",
          "product": "compressing",
          "versions": [
            {
              "version": ">=2.0.0, < 2.1.1",
              "status": "affected"
            },
            {
              "version": "< 1.10.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.9
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-22T13:51:59.094969Z",
          "id": "CVE-2026-40931",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:node-modules:compressing:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "1.10.5",
              "matchCriteriaId": "734A2799-2D6B-48E1-BA28-13633AB1A458"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:node-modules:compressing:*:*:*:*:*:node.js:*:*",
              "versionStartIncluding": "2.0.0",
              "versionEndExcluding": "2.1.1",
              "matchCriteriaId": "6445E79F-051C-40AF-A23A-6174BF2B41E8"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/node-modules/compressing/security/advisories/GHSA-4c3q-x735-j3r5",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}