CVE-2026-17514 in node-unzipper
Summary
by MITRE • 07/27/2026
A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability in ZJONSSON node-unzipper version 0.12.3 represents a critical path traversal flaw that exposes systems to arbitrary file system access. This security weakness resides within the Extract function of the lib/extract.js file, where insufficient input validation allows maliciously crafted zip archive entries to escape their intended directory boundaries. The vulnerability specifically affects the extraction process when handling compressed files containing specially constructed file paths that include directory traversal sequences such as ../ or ..\.. The issue is particularly concerning because it requires only local access to exploit, meaning an attacker with access to the system can manipulate the unzipper functionality to write files outside of the intended target directory.
The technical implementation of this vulnerability stems from inadequate sanitization of file paths during archive extraction operations. When node-unzipper processes compressed archives, it fails to properly validate or sanitize the filenames contained within the zip structure before writing them to the file system. This allows attackers to craft malicious zip files containing entries with absolute paths or traversal sequences that bypass normal directory restrictions. The flaw essentially enables an attacker to write files anywhere on the target system where the unzipper process has write permissions, potentially leading to arbitrary code execution, data exfiltration, or system compromise. According to CWE-22 Path Traversal and CWE-73 Arbitrary File Write, this vulnerability maps directly to well-established security weaknesses in file handling operations.
The operational impact of this vulnerability is significant for any system utilizing node-unzipper for processing untrusted zip archives. Attackers can leverage this flaw to overwrite critical system files, inject malicious code into existing applications, or create backdoor access points within the target environment. The local access requirement means that compromise could occur through various attack vectors including compromised user accounts, insider threats, or systems where attackers have already established a foothold. The fact that this vulnerability has been publicly disclosed and may be actively exploited increases the risk profile considerably, as it provides threat actors with documented techniques for exploitation. Organizations running vulnerable versions of node-unzipper face potential data loss, system integrity compromise, and unauthorized access to sensitive information.
Mitigation strategies should focus on immediate version updates to the latest stable release of node-unzipper where the path traversal vulnerability has been addressed through proper input validation and sanitization. System administrators should also implement additional protective measures such as restricting write permissions for unzipper processes, implementing directory restrictions during archive extraction, and monitoring file system changes that could indicate exploitation attempts. Security teams should conduct thorough assessments of systems using node-unzipper to identify potential exposure points and ensure that all instances are updated to patched versions. The vulnerability demonstrates the critical importance of input validation in file handling operations and aligns with ATT&CK technique T1059 Command and Scripting Interpreter, where path traversal can be used as an initial access vector or privilege escalation method. Organizations should also consider implementing network segmentation and access controls to limit potential damage from successful exploitation attempts, while maintaining regular security updates and vulnerability assessments to prevent similar issues in other dependencies.