Skip to content
OpenAdvisories

Package · Debian

node-extract-zip

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-56876 Public exploit

    extract-zip unvalidated symlink path traversal

    extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to p…

    max-mapper extract-zip node-extract-zip extract-zip Debian Ubuntu npm