Debian/node-extract-zip: high 8.1
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names -
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: DEBIAN-CVE-2026-19693#Debian:14/node-extract-zip
- https://security-tracker.debian.org/tracker/CVE-2026-19693
published · modified · JSON