Executive brief
cross-zip is a Node.js library for creating and extracting ZIP archives. The vulnerability allowed attackers to access arbitrary system files by chaining zip and unzip operations with specially crafted paths, potentially exposing sensitive data like system configuration files. However, this advisory has been withdrawn as it does not describe a valid vulnerability.
Technical details
The advisory alleged a directory traversal vulnerability (CWE-22) in cross-zip versions up to 4.0.1, where consecutive calls to zipSync() and unzipSync() with path arguments such as __dirname could be exploited to traverse the filesystem and access system files. A proof-of-concept demonstrated zipping /etc/passwd and extracting it to the current directory. The attack vector required the application to call both functions with attacker-controlled or predictable path arguments. This advisory was withdrawn on 2025-10-20 because it does not discuss a valid vulnerability.
Affected products
- Feross cross-zip all versions up to 4.0.1
Timeline
- 2025-10-10: disclosed: Advisory published
- 2025-10-20: other: Advisory withdrawn as invalid