Executive brief
extract-zip is a popular Node.js library for unzipping archives. The library fails to properly check if the final filename itself is a symlink before writing through it, allowing an attacker to craft a specially crafted ZIP file that writes arbitrary files outside the intended destination directory. An application using extract-zip to process untrusted archives could have its filesystem compromised, potentially leading to configuration tampering, code injection, or system compromise.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the symlink containment checks of extract-zip. The root cause is that the library only validates that the parent directory of each archive entry is safe, but fails to check the final path component itself for symlinks. An attacker can exploit this by creating a ZIP archive with two entries having identical names: first a symlink pointing to a path outside the destination directory, then a regular file. When the library extracts the regular file, it follows the symlink planted by the first entry, resulting in a write outside the intended destination. The attack requires user interaction (the victim must extract a malicious ZIP file) but no special privileges. The vulnerability affects all versions up to 2.0.1 with no official patch released as of the advisory date. A fix has been proposed via GitHub pull request #160.
Affected products
- max-mapper extract-zip <= 2.0.1
Timeline
- 2026-08-17: disclosed
- 2026-08-17: advisory: GitHub Advisory Database published GHSA-7pqw-9j4j-h8q3 and CVE-2026-19693
- 2026-09-08: other: GitHub Security Advisory reviewed and updated