Description
adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| node.js | adm-zip | unspecified – < 0.4.9 | 0.4.9 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | adm-zip | < 0.4.11 | 0.4.11 | GHSA-3v6h-hqm4-2rg6 |