Skip to content
OpenAdvisories

Package · Debian

node-extract-zip

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.1
    CVE-2026-19693

    extract-zip arbitrary file write outside the destination directory via a symlink at the final path component

    extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followe…

    max-mapper extract-zip extract-zip node-extract-zip Debian Ubuntu npm
  • High 8.1
    CVE-2026-56876 Public exploit

    extract-zip unvalidated symlink path traversal

    extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to p…

    max-mapper extract-zip node-extract-zip extract-zip Debian Ubuntu npm