Executive brief
ZJONSSON node-unzipper is a popular Node.js library used to extract ZIP archives. A security flaw allows a specially crafted ZIP file to write files to unintended locations on the system, potentially overwriting sensitive files or placing malicious code in sibling directories. This occurs because the library fails to properly verify that extracted files stay within the designated target folder.
Technical details
A path traversal vulnerability exists in node-unzipper up to version 0.12.3 within the Extract function in 'lib/extract.js' and 'lib/Open/directory.js'. The library attempts to prevent Zip Slip by checking if the destination path starts with the extraction root using 'indexOf(opts.path) == 0'. However, this check is insufficient as it does not account for directory boundaries; for example, an extraction root named 'out' can be bypassed by a traversal path like '../out2/evil.txt', which still satisfies the prefix check but writes to a sibling directory. An attacker with the ability to provide a malicious ZIP file for extraction can achieve arbitrary file write outside the intended directory. As of the advisory date, the project has not yet released a patch.
Affected products
- ZJONSSON node-unzipper up to 0.12.3
Timeline
- 2026-07-27: disclosed: Public disclosure via VulDB and NVD