Executive brief
unzip-crx is a Node.js library used to extract Chrome extension files (.crx). A path traversal vulnerability in the unzip function allows an attacker to write files outside the intended extraction directory by manipulating archive entry names, particularly on Windows systems. An attacker with the ability to supply a malicious .crx file could extract files to arbitrary locations on the system.
Technical details
The vulnerability is a path traversal (Zip Slip) flaw in the unzip function of dist/index.js within the archive extraction component. The root cause is insufficient validation of the destination parameter and archive entry names, allowing entries with backslash characters (particularly on Windows) to traverse outside the intended extraction directory. The attack requires local access and the ability to provide a malicious .crx file. An attacker can achieve arbitrary file write outside the extraction directory. The vulnerability affects unzip-crx and unzip-crx-3 up to version 0.2.0; the maintainers have been notified via GitHub issue #19 but have not yet responded with a patch.
Affected products
- peerigon unzip-crx up to 0.2.0
Timeline
- 2026-08-25: disclosed
- other: Exploit published and maintainers notified via GitHub issue #19 but have not responded