Source: node-extract-zip Version: 2.0.1+ds-1 Severity: important Tags: security upstream Forwarded: https://github.com/max-mapper/extract-zip/pull/160 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for node-extract-zip. CVE-2026-19693[0]: | extract-zip through 2.0.1 containment-checks only the parent | directory of each archive entry and never the entry's own final path | component, so an archive containing two entries with identical names | - a symlink whose target is outside the destination, followed by a | regular file - writes through the planted symlink and yields an | arbitrary file write outside the destination directory. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-19693 https://www.cve.org/CVERecord?id=CVE-2026-19693 [1] https://github.com/max-mapper/extract-zip/pull/160 Regards, Salvatore
