extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

Affected: npm: extract-zip

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

heroic-games-launcher-2.22.0-4.1 on GA media

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration form-data: form-data: Form field override via CRLF injection brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input devalue: devalue: Excessive memory consumption via deserialization of sparse arrays tmp: path Traversal via unsanitized prefix/postfix enables directory escape postcss: PostCSS: Information disclosure and denial of service via crafted CSS input ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` protobufjs: protobufjs: Denial of Service via crafted JSON descriptors grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosur…

Affected: Ubuntu:22.04:LTS: node-extract-zip, Ubuntu:24.04:LTS: node-extract-zip, Ubuntu:25.10: node-extract-zip, Ubuntu:26.04:LTS: node-extract-zip

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.