Executive brief
@appium/support is a Node.js library that provides utilities for the Appium test automation framework, including ZIP file extraction functionality used to handle application packages and test artifacts. A flaw in the ZIP extraction code allows attackers to write arbitrary files outside the intended extraction directory when processing malicious ZIP archives—potentially overwriting critical application files or injecting code if an automated system extracts untrusted archives.
Technical details
The vulnerability is a path traversal (Zip Slip) flaw in the ZipExtractor.extract() method at line 88 of packages/support/lib/zip.js. The code creates an Error object for out-of-bounds paths but does not throw it (missing `throw` keyword), rendering the traversal check inert. Attackers can craft ZIP files with path entries containing ../ components to escape the extraction directory and write files anywhere the Appium process has permissions. The attack requires network reachability (malicious ZIP supplied via URL or file upload) and user interaction (someone must initiate extraction), but requires no authentication. The vulnerability affects all JavaScript-based extractions by default; the optional system unzip fallback provides protection only if explicitly enabled and only if the system binary succeeds. Patched in version 7.0.6.
Affected products
- Appium @appium/support <=7.0.5
Timeline
- 2026-03-11: disclosed
- 2026-03-11: patched: Version 7.0.6 released