Repository navigation
Critical vulnerablity in fast-folder-size v2.4.0 #205
Description
Hi,
There is a critical vulnerablity in version 2.4.0.
In fast-folder-size@2.4.0 -> decompress@4.2.1
The critical finding is its transitive dependency, decompress@<=4.2.1:
GHSA-mp2f-45pm-3cg9, CVSS 9.1
Archive extraction can write files or create links outside the destination directory.
This is a path-traversal / Zip Slip-style vulnerability: a malicious archive can potentially overwrite arbitrary files accessible to the process.
Activity
simoneb commentedon Sep 23, 2026
Thanks for the report!
decompressis only used by the Windows postinstall script to extract Sysinternals'DU.zip, which is downloaded over HTTPS from sysinternals.com (or from a mirror/local file you configure yourself), so exploiting it would require a tampered archive from that source. Still, the advisory has no patcheddecompressrelease, so the dependency is gone entirely.#206 replaces it with the
tar.exethat ships with Windows, used only to list the archive and stream the few known entries to stdout; the files are written by name intobin/, so nothing inside the archive can influence where anything is written. A fixture covering../entries and symlinks is part of the tests.It will be released as a patch version shortly.