CVE-2026-17514 | ZJONSSON node-unzipper up to 0.12.3 lib/extract.js Extract path traversal (Issue 357)

July 27, 2026 Yanac

A vulnerability was found in ZJONSSON node-unzipper up to 0.12.3. It has been rated as critical. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal.

This vulnerability appears as CVE-2026-17514. The attack requires local access. In addition, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More