CVE-2026-78638 in unzip-crx
Summary
by MITRE • 08/25/2026
A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in peerigon unzip-crx and its successor unzip-crx-3, specifically within versions up to 0.2.0, represents a critical security flaw located in the Archive Extraction component's unzip function found in dist/index.js. This issue stems from an improper validation of user-supplied input regarding the destination argument passed during archive extraction operations. When an attacker manipulates this argument by injecting path traversal sequences such as dot-dot-slash patterns, they can exploit the lack of sanitization to write files outside of the intended target directory. This type of flaw is classically categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which highlights the failure to enforce strict boundaries on file system access paths during extraction processes.
The operational impact of this vulnerability allows for arbitrary file creation or overwriting within the local file system context where the application executes. Although the attack vector is restricted to local execution, meaning it cannot be triggered remotely by an external adversary without prior code execution privileges, its implications remain severe in scenarios involving untrusted archive processing. An attacker with local access could potentially overwrite configuration files, inject malicious scripts into executable directories, or disrupt service integrity by corrupting critical data stores. This aligns with the ATT&CK technique T1036: Masquerading, as attackers often use path traversal to place payloads in locations that mimic legitimate system paths to evade detection and maintain persistence on compromised systems.
The fact that an exploit has been published indicates that the technical mechanism for leveraging this flaw is well-understood and readily available for testing or malicious intent. The project's lack of response despite early notification through issue reports suggests a potential gap in security maintenance practices, leaving users exposed until they manually patch their dependencies or switch to alternative libraries with more active security oversight. This situation underscores the importance of supply chain security and the need for developers to verify the responsiveness and security posture of third-party components before integration into production environments.
To mitigate this risk, immediate remediation involves upgrading unzip-crx-3 to a version that addresses these path validation issues or replacing it with a more robust archive extraction library that implements strict allow-listing of file paths during decompression. Developers should also implement defensive coding practices by validating and canonicalizing all destination paths before passing them to the extraction function, ensuring they resolve within an expected base directory. Additionally, running applications with minimal privileges limits the potential damage if such a vulnerability is exploited in other contexts. Regular auditing of dependencies for known vulnerabilities using automated tools can help identify similar risks across the software supply chain, reducing exposure to locally exploitable flaws that could escalate into broader system compromises.