CVE-2026-10732

@@ -26,7 +26,7 @@ const safeMakeDir = (dir, realOutputPath) => {
 			return safeMakeDir(parent, realOutputPath);
 		})
 		.then(realParentPath => {
-			if (realParentPath.indexOf(realOutputPath) !== 0) {
+			if (realParentPath !== realOutputPath && !realParentPath.startsWith(realOutputPath + path.sep)) {
 				throw (new Error('Refusing to create a directory outside the output path.'));
 			}
 
@@ -103,7 +103,7 @@ const extractFile = (input, output, opts) => runPlugins(input, opts).then(files
 			.then(realOutputPath => {
 				return fsP.realpath(path.dirname(dest))
 					.then(realDestinationDir => {
-						if (realDestinationDir.indexOf(realOutputPath) !== 0) {
+						if (realDestinationDir !== realOutputPath && !realDestinationDir.startsWith(realOutputPath + path.sep)) {
 							throw (new Error('Refusing to write outside output directory: ' + realDestinationDir));
 						}
 					});

@@ -13,6 +13,7 @@ const rimrafP = pify(rimraf);
 test.serial.afterEach('ensure decompressed files and directories are cleaned up', async () => {
 	await rimrafP(path.join(__dirname, 'directory'));
 	await rimrafP(path.join(__dirname, 'dist'));
+	await rimrafP(path.join(__dirname, 'dist-evil'));
 	await rimrafP(path.join(__dirname, 'example.txt'));
 	await rimrafP(path.join(__dirname, 'file.txt'));
 	await rimrafP(path.join(__dirname, 'edge_case_dots'));
@@ -158,3 +159,14 @@ test.serial('throw when chained symlinks to /tmp/dist allow escape outside root
 		await m(path.join(__dirname, 'fixtures', 'slip3.zip'), '/tmp/dist');
 	}, {message: /Refusing/});
 });
+
+test.serial('throw when symlink target shares output path as string prefix (indexOf bypass)', async t => {
+	// Regression test for the indexOf prefix confusion bypass.
+	// A symlink pointing to '../dist-evil' resolves to a sibling whose path
+	// starts with the output path string 'dist' — indexOf passes it, startsWith + sep does not.
+	fs.mkdirSync(path.join(__dirname, 'dist-evil'), {recursive: true});
+	await t.throwsAsync(async () => {
+		await m(path.join(__dirname, 'fixtures', 'slip-prefix.tar.gz'), path.join(__dirname, 'dist'));
+	}, {message: /Refusing/});
+	t.false(fs.existsSync(path.join(__dirname, 'dist-evil', 'pwned.txt')));
+});